Search every filing
2,477,667 paragraphs from 10-Ks, 10-Qs and 8-Ks with press releases.
Matching paragraphs
• Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate. GE Aerospace’s cybersecurity teams respond to incidents and seek to improve our cybersecurity incident management plan through periodic tabletops or simulations.
Read in the filing ↗ Also in 10-K of Feb 3, 2025
• Third-party service providers: We have third-party cybersecurity companies engaged to periodically assess GE Aerospace’s cybersecurity posture, to assist in identifying and remediating risks from cybersecurity threats, and to assist with various incident response workstreams.
Read in the filing ↗
We have experienced, and expect to continue to experience, cyberattacks of varying degrees of sophistication and various cybersecurity incidents, such as distributed denial of service attacks and phishing attacks that resulted in unauthorized access to systems and data. While to date no incidents have materially impacted our business, there is no guarantee that material incidents will not occur in the …
Read in the filing ↗ Also in 10-K of Feb 3, 2025
Cybersecurity and data privacy laws are rapidly evolving, vary significantly by country, and present increasing compliance challenges. We periodically receive regulatory inquiries regarding specific incidents or aspects of our cybersecurity framework, which can increase costs, affect competitiveness, and expose us to fines, penalties, or reputational risks. Expanding global cybersecurity requirements, such as the Department of War's NIST and Cybersecurity Maturity Model Certification requirements, also impose additional obligations on us and our suppliers, heightening the risk of noncompliance, operational disruptions and regulatory enforcement. In addition, cybersecurity incidents can result in other negative consequences, regardless of whether the direct effects of an incident are significant, including damage to our reputation or competitiveness, restoration and remediation costs, increased digital infrastructure or related costs that are not covered by insurance, and costs or fines arising from litigation or regulatory investigations or actions. While we carry cyber insurance, we cannot be certain that our coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim.
Read in the filing ↗
Cybersecurity-related and data privacy and protection laws and regulatory regimes are evolving, can vary significantly by country and present increasing compliance challenges, and we from time to time receive, and in the future will likely receive, regulatory inquiries about specific incidents or aspects of our cybersecurity framework; these dynamics increase our costs, affect our competitiveness and can expose us to fines or other penalties and reputational risks. In addition, cybersecurity incidents can result in other negative consequences, regardless of whether the direct effects of an incident are significant, including damage to our reputation or competitiveness, restoration and remediation costs, increased digital infrastructure or related costs that are not covered by insurance, and costs or fines arising from litigation or regulatory investigations or actions. While we carry cyber insurance, we cannot be certain that our coverage will be adequate for liabilities actually incurred, that insurance will continue to be available to us on economically reasonable terms, or at all, or that any insurer will not deny coverage as to any future claim.
Read in the filing ↗
CYBERSECURITY GOVERNANCE. The Audit Committee of the GE Aerospace Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee reports back to the full Board about this and other areas within its responsibility. As part of its oversight role, the Audit Committee receives reporting about GE Aerospace’s practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates from GE Aerospace’s Chief Information Officer (CIO) and Chief Information Security Officer (CISO) on cyber threats and our cybersecurity risk management strategy. The Audit Committee also receives information about cybersecurity risks as part of GE Aerospace’s enterprise risk management framework and reporting.
Read in the filing ↗ Also in 10-K of Jan 29, 2026
GE Aerospace’s management team is ultimately responsible for assessing and managing risks from cybersecurity threats, and in this regard, the CIO and CISO lead the Company’s overall cybersecurity function and cybersecurity leadership team. The CIO has over 25 years of experience in the information technology (IT) field and leads the IT strategy and services supporting the Company’s global operation. The CISO has over 25 years of experience focused on global information assurance and cyber security programs. The cybersecurity leadership team meets with senior management to review and discuss GE Aerospace’s cybersecurity program, including emerging cyber risks, threats and industry trends. The cybersecurity leadership team also assists management in supervising efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with internal security personnel and business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public or private sources to inform our cybersecurity technologies and processes.
Read in the filing ↗ Also in 10-K of Jan 29, 2026
We also consider cybersecurity, along with other top risks for GE Aerospace, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. We face certain ongoing risks from cybersecurity threats - including heightened threats in connection with the separation of GE Vernova - that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, financial condition or cash flows. Refer to the Risk Factors section (Cybersecurity - Increased cybersecurity requirements, vulnerabilities, threats and more sophisticated and targeted computer crime, as well as cybersecurity failures, pose risk to our systems, networks, products, solutions, services and data.) for additional information about these risks.
Read in the filing ↗ Also in 10-K of Feb 3, 2025
… In addition, a cybersecurity incident that impacts our partners, suppliers or customers could compromise our systems and impact our intellectual property, personal data or other confidential information, or result in production downtimes and operational disruptions that could cause us to breach our commitments to customers. Any security vulnerability or malicious software in a product used by a partner or supplier …
Read in the filing ↗
… In addition, a cybersecurity incident that impacts our partners, suppliers or customers could compromise our systems and impact our intellectual property, personal data or other confidential information, or result in production downtimes and operational disruptions that could cause us to breach our commitments to customers. Any security vulnerability or malicious software in a product used by a partner or supplier …
Read in the filing ↗