Company: BWXT
Filing Date: 2025-03-19
Form Type: 10-K/A
Source: 0001486957-25-000015
Chunk: 52

Company: BWX Technologies, Inc.
Filing Date: 2025-03-19
Form: 10-K/A
Chunk 52
---
 are still possible. In general, when our cybersecurity team detects a cybersecurity threat by way of an alert within our cyber defense systems, employee notice, or otherwise, our IT Director, Cyber Security, along with other relevant personnel, is promptly apprised of the situation, and actively takes steps to prevent, mitigate, or remediate that threat. If a cybersecurity threat appears to progress into a possible cybersecurity incident, our IT Director, Cyber Security serves as the CIMT’s incident manager and the CDO or designee notifies the Chief Risk

<div align='center'>27</div>

Officer of a need to activate the CIMT as appropriate, informs and updates the CIMT and may consult other internal and external resources with the required technical, application, organizational and business knowledge to provide effective advice to the CIMT.

The CIMT responds to potential cybersecurity incidents raised to its attention by making an assessment of the event to determine if a cybersecurity incident has, in fact, occurred, identifying any assets impacted by the incident, determining any information stored and processed by assets identified as compromised, assessing the nature and level of damage that has occurred (accessed, exfiltrated, released to the public, etc.) and revising the assessment throughout the incident response process when additional details are identified.

As a U.S. Government contractor, we may be prone to a greater number of cybersecurity threats than companies in other industries. We believe we are well positioned to meet the requirements of the Cybersecurity Maturity Model Certification ("CMMC") program and are preparing for certification once the requirements are effective. As of the date of this Report, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. However, there can be no guarantee that cybersecurity threats and incidents will not materially affect us in the future. See Item 1A of this Report for more information on our cybersecurity risks.

<div align='center'>28</div>

## Item 2. PROPERTIES
The following table provides the segment name, location and general use of each of our principal properties at December 31, 2024 that we own or lease:

| Business Segment and Location       |     | Principal Use                 |     | Owned/Leased       
 (Lease Expiration) |
| Government Operations               |     |                               |     |                    |
| Lynchburg, Virginia                 |     | Manufacturing facility(1) (4) |     | Owned              |
| Barberton, Ohio