XML 48 R32.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Our Cybersecurity Program includes the following four core components: Cyber Operations; Cyber and Information Technology Governance and Compliance; Classified Information Systems; and Cyber/Supplier Risk Management.
The Cyber Operations team is responsible for maintaining prevention, detection, and response capabilities in a defense-in-depth infrastructure. The prevention, detection, and response capabilities leverage various tools and services. The Cyber Operations team is engaged to provide timely incident response and works to minimize adverse impacts to our operations.
The Cyber and Information Technology Governance and Compliance team works to align the Company’s cyber approach to requirements such as NIST 800-171, CMMC, and other information technology general controls. The Cyber and Information Technology Governance team develops Company policies designed to reduce, manage, and mitigate cyber risks.
The Classified Information team maintains the Company’s classified information systems and works closely with the Company’s Industrial Security team to help the Company meet the requirements laid out by the DoD for classified systems.
The Cyber/Supplier Risk Management team collaborates with the Company’s supply chain function to identify and work with critical suppliers to reduce cyber risk and minimize or eliminate collateral impacts.
As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DoD. We have implemented cybersecurity policies and frameworks based on industry and governmental standards to align closely with DoD requirements, instructions and guidance.
We also participate and support multiple threat-sharing communities including the National Defense Information Sharing and Assessment Center, the defense industrial base Cybersecurity Program, and the National Defense Cyber Alliance. Participating in these communities allows us to collaborate with our Defense Industrial Base sector peers, government agencies, information sharing and analysis centers, and cybersecurity associations. The Cybersecurity Program staff also maintains regular contact with the Federal Bureau of Investigation for sharing of threat information.
Third parties play a key role in support of our Cybersecurity Program. The Chief Information Security Officer coordinates third-party assessments with the Company’s Internal Audit team. Third parties are
regularly engaged to assess our security controls and incident response capabilities. We invest in tools to assess our external vulnerabilities and perform penetration testing regularly.
Third-party assessment findings are logged in our internal audit system and tracked until mitigated and/or remediated. These assessments are documented and reviewed with the Company’s Chief Executive Officer and Chairman, Chief Operating Officer, Chief Information Officer, General Counsel, as well as the Government Security Committee (“GSC”) of the Board. Both the Internal Audit team and the Chief Information Security Officer are responsible for reporting any material assessment findings to their respective Board committees.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Our Cybersecurity Program includes the following four core components: Cyber Operations; Cyber and Information Technology Governance and Compliance; Classified Information Systems; and Cyber/Supplier Risk Management.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our Board oversees management’s processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior leadership, including our Chief Information Security Officer, regularly briefs our Board through the GSC depending on the nature and severity of the business impact. The Chief Information Security Officer also provides the GSC with an update on the Company’s risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. Cyber assessments are performed no less than annually. The full Board retains oversight of cybersecurity because of its importance and the heightened risk in the defense industry.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Senior leadership, including our Chief Information Security Officer, regularly briefs our Board through the GSC depending on the nature and severity of the business impact. The Chief Information Security Officer also provides the GSC with an update on the Company’s risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. Cyber assessments are performed no less than annually. The full Board retains oversight of cybersecurity because of its importance and the heightened risk in the defense industry.
Cybersecurity Risk Role of Management [Text Block] Senior leadership, including our Chief Information Security Officer, regularly briefs our Board through the GSC depending on the nature and severity of the business impact. The Chief Information Security Officer also provides the GSC with an update on the Company’s risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. Cyber assessments are performed no less than annually. The full Board retains oversight of cybersecurity because of its importance and the heightened risk in the defense industry.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Senior leadership, including our Chief Information Security Officer, regularly briefs our Board through the GSC depending on the nature and severity of the business impact. The Chief Information Security Officer also provides the GSC with an update on the Company’s risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. Cyber assessments are performed no less than annually. The full Board retains oversight of cybersecurity because of its importance and the heightened risk in the defense industry.
The Cyber Program is organized under our Chief Information Security Officer. The current Chief Information Security Officer has extensive information technology and program management experience and has served for over a decade in our corporate information security organization. He has a Masters in cybersecurity from Valparaiso University. Additionally, he has both Certified Information Systems Security Professional-Information Systems Security Management Professional (“CISSP-ISSMP”) and Certified Information Systems Auditor (“CISA”) certifications, and is also a recognized Information Technology Infrastructure Library (“ITIL”) expert. The Chief Information Security Officer reports to the Executive Vice President, General Counsel & Secretary with oversight by the Board of Directors. Over the course of the last decade, our management team has gained extensive experience investing in, providing oversight of, and setting the strategy for our cybersecurity program. Prior to joining DRS, our Chief Executive Officer oversaw the development of the DoD cybersecurity strategy while serving as Deputy Secretary of Defense from 2009 to 2011.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The current Chief Information Security Officer has extensive information technology and program management experience and has served for over a decade in our corporate information security organization. He has a Masters in cybersecurity from Valparaiso University. Additionally, he has both Certified Information Systems Security Professional-Information Systems Security Management Professional (“CISSP-ISSMP”) and Certified Information Systems Auditor (“CISA”) certifications, and is also a recognized Information Technology Infrastructure Library (“ITIL”) expert.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Senior leadership, including our Chief Information Security Officer, regularly briefs our Board through the GSC depending on the nature and severity of the business impact. The Chief Information Security Officer also provides the GSC with an update on the Company’s risk management process and the risk trends related to cybersecurity at least annually. The Audit Committee maintains oversight of material risk mitigation recommendations identified by third-party assessors and receives reports as assessments occur. Cyber assessments are performed no less than annually.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true