Search every filing
2,477,667 paragraphs from 10-Ks, 10-Qs and 8-Ks with press releases. All words must appear; put a phrase in "quotes".
Matching paragraphs
13 paragraphs · newest first, each linked to its filing
• The Company is increasingly exposed to cybersecurity attacks and data incidents impacting its IT Systems, or those of the Company’s vendors or service providers. Such cybersecurity incidents or data incidents could have a disruptive and material adverse effect on the Company’s business, financial position, or results of operations.
Also in 10-K of Feb 7, 2025, 10-K of Feb 5, 2026, 10-K of Feb 5, 2026
The Company has a dedicated cybersecurity incident response team responsible for managing and coordinating the Company’s cybersecurity incident response efforts. This team collaborates closely with other internal teams as well as with external experts such as legal advisors, communication specialists, and other key stakeholders, as appropriate, in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks cybersecurity incidents to help identify and analyze them. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and
Also in 10-K of Feb 7, 2025
escalating cybersecurity incidents, as appropriate, to senior management, the Audit Committee, and the Board. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide hands-on training for the participants and helps the Company assess its cybersecurity response plan and its processes and capabilities in addressing cybersecurity threats.
The Company’s cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, incident response, security operations, vulnerability management, risk and compliance and security engineering. These teams conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. Leaders from each team regularly meet with the Cybersecurity Leaders to provide visibility of relevant issues and seek alignment with strategy. As noted above under “Incident Response,” the Company’s cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents, as appropriate, to senior management, the Audit Committee, and the Board. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. The Company’s incident response team also coordinates, as needed, with external legal advisors, communication specialists, and other key stakeholders.
Also in 10-K of Feb 5, 2026
Although the Company has not experienced cyber incidents that are individually, or in the aggregate, material, the Company and certain of its vendors and service providers have experienced cyber-attacks and cybersecurity incidents in the past, which have thus far been mitigated by preventative, detective, and responsive measures.
Also in 10-K of Feb 5, 2026
The Audit Committee. The Audit Committee reviews with management the Company’s technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile as needed at its regularly scheduled meetings. The Company’s CIO, CISO, members of the cybersecurity team, or other advisors, as requested by the Audit Committee, report quarterly on the Company’s technology, data protection, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Audit Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Management believes that this regular cadence of reporting helps to provide the Audit Committee with an informed understanding of the Company’s dynamic cybersecurity program and threat landscape. As needed, the Audit Committee reviews with
As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably likely to have a material effect on the Company's business strategy, results of operations, or financial condition. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company and its service providers have experienced cyber-attacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place. For a detailed discussion of the Company’s cybersecurity related risks, see “Item 1A Risk Factors - Information Technology, Cybersecurity, and Data Privacy Risks.”
Also in 10-K of Feb 5, 2026
and risks. Cybersecurity topics are presented to the Audit Committee on a periodic basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Management believes that this regular cadence of reporting helps to provide the Audit Committee with an informed understanding of the Company’s dynamic cybersecurity program and threat landscape. As needed, the Audit Committee reviews with management the Company’s business continuity and disaster recovery plans and capabilities and the effectiveness of the Company’s escalation procedures. Based on these management reports, the Audit Committee may request follow-up information and presentations to address any specific concerns and recommendations. In addition to this regular reporting, cybersecurity risks or threats may also be escalated on an as-needed basis to the Audit Committee.
The Company has experienced heightened legislative and regulatory focus on cybersecurity from a critical infrastructure perspective, a federal contractor perspective, and broadly applicable cybersecurity legal obligations. As a result, the Company must comply with a developing set of cybersecurity requirements, including but not limited to incident and other reporting, internal and external coordination, affirmative risk‑management obligations, compliance, and technical …
The Company has a dedicated cybersecurity team and program, along with support from legal advisors and other resources, focused on current and emerging data security matters. The Company’s systems and cybersecurity measures require ongoing monitoring and updating as technologies change, and security could be compromised, personal or confidential information could be misappropriated, or system disruptions could occur. The Company may also incur significant costs to modify, upgrade, or enhance its cybersecurity measures to protect and defend against such attacks and breaches. The Company may not be able to anticipate, detect, or prevent cyber-attacks, security breaches, or data incidents, particularly because the methodologies used by threat actors change frequently or may not be recognized until such attack is launched or for a substantial period thereafter, and because threat
actors are increasingly using technologies specifically designed to circumvent cybersecurity measures and avoid detection. Moreover, even with the efforts and investments to protect against cyber-attacks, the Company may not be able to prevent a data breach involving sensitive data. A successful breach of the Company’s IT Systems could erode Customer confidence in the Company’s digital platforms, security measures, data protection, resiliency, and services. Beyond operational disruptions, such incidents could result in reputational damage, loss of Customer trust, regulatory investigations and fines, or individual or class action lawsuits, all of which could have a material adverse effect on the Company’s financial condition and results of operations. See “Business - Regulation - Data Privacy and Cybersecurity Regulation.”
… The Company may also incur significant costs to modify, upgrade, or enhance its cybersecurity measures to protect and defend against such attacks and breaches. The Company may not be able to anticipate, detect, or prevent cyber-attacks, security breaches, or data incidents, particularly because the methodologies used by threat actors change frequently or may not be recognized until such attack …
… For example, cybersecurity incidents impacting the Company's IT Systems or those provided by a vendor or service provider could disrupt the Company’s operations and even impact the safe operation of physical assets like aircraft. Any of these outcomes could significantly harm the Company’s operations, financial health, and business results.
Also in 10-K of Feb 5, 2026