Company: NOC
Filing Date: 2025-01-30
Form Type: 10-K
Source: 0001133421-25-000006
Chunk: 72

Company: NORTHROP GRUMMAN CORP /DE/
Filing Date: 2025-01-30
Form: 10-K
Item: Item 1C
Chunk 72
---
 and functional stakeholder engagements with legal, privacy and risk management, among others. Depending on the nature and severity of an incident, this process provides for escalating notification to our CEO and the Board (including our Lead Independent Director and the Audit and Risk Committee chair), as appropriate.

Our approach to cybersecurity risk management includes the following key elements:•Multi-Layered Defense and Continuous Monitoring – We work to protect our computing environments and products from cybersecurity threats through multi-layered defenses and apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We utilize data analytics to detect anomalies and search for cyber threats. Our Cybersecurity Operations Center provides comprehensive cyber threat detection and response capabilities and maintains a 24x7 monitoring system which complements the technology, processes and threat detection techniques we use to monitor, manage and mitigate cybersecurity threats or vulnerabilities. From time to time, we engage third-party consultants or other advisors to assist in assessing, identifying and/or managing cybersecurity threats. We also periodically use our Internal Audit function to conduct additional reviews and assessments. •Insider Threats – We maintain an insider threat program, led by our Vice President, Corporate and Enterprise Security, designed to identify, assess, and address potential risks from within our company. Our 

-21-

NORTHROP GRUMMAN CORPORATION                        

program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations.•Information Sharing and Collaboration – We work with government, customer, industry and/or supplier partners, such as the National Defense Information Sharing and Analysis Center and other government-industry partnerships, to gather and develop best practices and share information to address cyber threats. These relationships enable the rapid sharing of threat and vulnerability mitigation information across the defense industrial base and supply chain.•Third Party Risk Management – We conduct cybersecurity assessments before sharing or allowing the hosting or processing of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain cybersecurity and data protections and controls. Finally, we require these third parties to notify us promptly of cyber incidents or data breaches so that we can assess potential impact on us.•Training and Awareness – We provide annual cybersecurity and information security awareness training to our employees with network access to help identify, avoid and mitigate cybersecurity threats and insider risks. This training also includes awareness about the policies and guidance associated with data privacy and protection of personal information, and protection and security of our company, customer and other third-party data. Our employees with network access also participate in annual spear phishing exercises. We also periodically host