Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Dec. 31, 2025 | |
| Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Our Cybersecurity Program As described below, we have established policies, standards, processes and practices for assessing, identifying and managing material risks from cybersecurity threats, which are integrated into our overall risk management program and governance structure. Our Cybersecurity Program includes the following four core components: Cyber Operations; Cyber and Information Technology Governance and Compliance; Classified Information Systems; and Cyber/Supplier Risk Management. •The Cyber Operations team is responsible for maintaining prevention, detection, and response capabilities in a defense-in-depth infrastructure. The prevention, detection, and response capabilities leverage various tools and services. However, this does not mean that we will meet, or maintain, any particular technical standard, specification, framework, or requirement in the future. The Cyber Operations team is engaged to provide timely incident response and works to minimize adverse impacts to our operations. •The Cyber and Information Technology Governance and Compliance team works to align the Company’s cyber approach to frameworks such as NIST 800-171, CMMC, and other information technology general controls. The Cyber and Information Technology Governance team develops Company policies designed to reduce, manage, and mitigate cyber risks. •The Classified Information Systems team maintains the Company’s classified information systems and works closely with the Company’s Industrial Security team to help the Company meet the requirements laid out by the DoW for classified systems. •The Cyber/Supplier Risk Management team collaborates with the Company’s supply chain function to identify and work with critical suppliers to reduce cyber risk and minimize or eliminate collateral impacts. As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DoW. We have implemented cybersecurity policies and frameworks based on industry and governmental standards to align closely with DoW requirements, instructions and guidance. We also participate and support multiple threat-sharing communities including the National Defense Information Sharing and Assessment Center, the defense industrial base Cybersecurity Program, and the National Defense Cyber Alliance. Participating in these communities allows us to collaborate with our Defense Industrial Base sector peers, government agencies, information sharing and analysis centers, and cybersecurity associations. The Cybersecurity Program staff also maintains contact with the Federal Bureau of Investigation for sharing of threat information. Third parties play a key role in support of our Cybersecurity Program. The Chief Information Security Officer coordinates third-party assessments with the Company’s internal audit team. Third parties are regularly engaged to assess our security controls and incident response capabilities. We invest in tools to assess our external vulnerabilities and perform penetration testing regularly. Third-party assessment findings are logged in our internal audit system and tracked until mitigated and/or remediated. These assessments are documented and reviewed with the Company’s Chief Executive Officer, Chief Operating Officer, Chief Information Officer, General Counsel, as well as the Government Security Committee (“GSC”) of the Board. Both the internal audit team and the Chief Information Security Officer are responsible for reporting any material assessment findings to their respective Board committees. We also maintain third-party management processes to identify and manage the cybersecurity risks associated with third-party service providers.
|
| Cybersecurity Risk Management Processes Integrated [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Text Block] | Our Cybersecurity Program includes the following four core components: Cyber Operations; Cyber and Information Technology Governance and Compliance; Classified Information Systems; and Cyber/Supplier Risk Management. |
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false |
| Cybersecurity Risk Board of Directors Oversight [Text Block] | Our Board oversees management’s processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Security Officer, regularly briefs our Board through the GSC depending on the nature and severity of the business impact. The Chief Information Security Officer also provides the GSC with an update on the Company’s risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. Cyber assessments are performed no less than annually. The full Board retains oversight of cybersecurity because of its importance and the heightened risk in the defense industry.
|
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. |
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Senior leadership, including our Chief Information Security Officer, regularly briefs our Board through the GSC depending on the nature and severity of the business impact. The Chief Information Security Officer also provides the GSC with an update on the Company’s risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. Cyber assessments are performed no less than annually. The full Board retains oversight of cybersecurity because of its importance and the heightened risk in the defense industry.
|
| Cybersecurity Risk Role of Management [Text Block] | Senior leadership, including our Chief Information Security Officer, regularly briefs our Board through the GSC depending on the nature and severity of the business impact. The Chief Information Security Officer also provides the GSC with an update on the Company’s risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. Cyber assessments are performed no less than annually. The full Board retains oversight of cybersecurity because of its importance and the heightened risk in the defense industry.
|
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | Senior leadership, including our Chief Information Security Officer, regularly briefs our Board through the GSC depending on the nature and severity of the business impact. The Chief Information Security Officer also provides the GSC with an update on the Company’s risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. Cyber assessments are performed no less than annually. The full Board retains oversight of cybersecurity because of its importance and the heightened risk in the defense industry. The Cybersecurity Program is organized under our Chief Information Security Officer. The current Chief Information Security Officer has extensive information technology and program management experience and has served for over a decade in our corporate information security organization. He has a Masters in cybersecurity from Valparaiso University. Additionally, he has both Certified Information Systems Security Professional-Information Systems Security Management Professional (“CISSP-ISSMP”) and Certified Information Systems Auditor (“CISA”) certifications, and is also a recognized Information Technology Infrastructure Library (“ITIL”) expert. The Chief Information Security Officer reports to the Executive Vice President, General Counsel & Secretary with oversight by the Board. Over the course of the last decade, our management team has gained extensive experience investing in, providing oversight of, and setting the strategy for our Cybersecurity Program.
|
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The current Chief Information Security Officer has extensive information technology and program management experience and has served for over a decade in our corporate information security organization. He has a Masters in cybersecurity from Valparaiso University. Additionally, he has both Certified Information Systems Security Professional-Information Systems Security Management Professional (“CISSP-ISSMP”) and Certified Information Systems Auditor (“CISA”) certifications, and is also a recognized Information Technology Infrastructure Library (“ITIL”) expert. |
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | Senior leadership, including our Chief Information Security Officer, regularly briefs our Board through the GSC depending on the nature and severity of the business impact. The Chief Information Security Officer also provides the GSC with an update on the Company’s risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. Cyber assessments are performed no less than annually. |
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |