We maintain documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyberattacks. Our cybersecurity strategy and risk management processes use the National Institute of Standards and Technology governance requirements and cybersecurity framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

Our approach to cybersecurity risk management includes multiple complementary elements to mitigate our cybersecurity risks. We utilize multi-layered defenses to help prevent attacks including the use of data analytics to help detect anomalies and search for cyber threats. We have comprehensive cyber threat detection and response capabilities with applied threat intelligence, and continuous monitoring to complement other technology, processes and threat detection techniques we have in place. We subscribe to third-party threat intelligence and managed security services that continuously monitor our systems and networks to assist with early cybersecurity threat detection and protection.

We work with government, customer, industry and/or supplier partners to gather and develop policies and standards and share information to address cyber threats. We conduct information security assessments of partners before sharing or allowing the hosting of data in computing environments managed by third parties. We require our employees to regularly complete phishing and other awareness training to help identify, avoid and mitigate cybersecurity threats.

While our primary focus is on prevention and detection of cybersecurity threats, we have response and recovery plans in effect, as well as service agreements with outside experts should there be a need for us to respond to an attack. We have adopted a cybersecurity incident response plan that provides direction and a defined approach for preparing for, identifying and responding to cybersecurity incidents that may pose a potential threat to our information systems, networks and data. The detailed plan defines the roles and responsibilities of all parties included in our cybersecurity incident response team which incorporates our IT team, senior management, and other functional areas.

We also have controls and procedures for reporting material cybersecurity incidents, including review of significant cybersecurity incidents by a cross-functional team to determine whether further escalation is necessary. We also periodically conduct practice exercises with management to reinforce the management team with our cyber incident response capabilities and processes. We also conduct internal and third-party assessments or penetration tests to validate our cybersecurity controls and improve our security posture. We also maintain cybersecurity liability insurance coverage.

Our Chief Information Security Officer (“CISO”) partners with management in internal functions, such as finance, legal, and internal audit, in overseeing information security risks, as well as third-party consultants who perform risk-based assessments with recommendations for designing, implementing, executing, monitoring, and improving our cybersecurity risk management program and strategies, which helps align our programs and strategies with our business and operational objectives. Results of third-party assessments are shared with the Audit Committee and the Board of Directors.

We maintain documented information security policies and standards to protect operations, assets, data and services and to defend against, respond to and recover from potential cyberattacks. Our cybersecurity strategy and risk management processes use the National Institute of Standards and Technology governance requirements and cybersecurity framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

Our CISO/Acting CDTO has extensive experience and expertise in developing, implementing and operating security policies and procedures covering our network and critical data. Our CISO/Acting CDTO has 35 years of experience in information technology systems and is a 27-year military veteran of the U.S. Navy and Navy Reserve with a Top Secret/Sensitive Compartmented Information (TS/SCI) U.S. security clearance and multiple combat deployments in information warfare. Additionally, our CISO/Acting CDTO holds several certifications, including, among others, the following security certifications: Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), Certified Network Defense Analyst (CNDA), Disaster Recovery Institute International (DRII), and CompTIA Network+ and Security+.