Company: SPR
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001628280-25-009088
Chunk: 37

Company: Spirit AeroSystems Holdings, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1A
Chunk 37
---
 of any future incident cannot be predicted and we cannot provide assurance that these processes and procedures will be sufficient to prevent cyber security threats from materializing. Although we have 

22

not been materially impacted to date by a cyber security incident, we could experience significant operational impacts, financial or information losses and/or reputational harm in the future. Given the increasing complexity and sophistication of the tools and techniques used by threat actors, cyber-attacks can occur and persist for an extended period of time before being detected, and we may not be able to anticipate these acts or respond timely. The extent of a particular cyber incident and the steps that we may need to take to investigate the incident may not be immediately clear, and it can take a significant amount of time before an investigation of the incident can be completed and full and reliable information about the incident is known, if ever. While an investigation is ongoing, we may not know the extent of the harm caused by a cybersecurity incident or how best to remediate any harm. Moreover, new regulations may require us to disclose information about a material cybersecurity incident before it has been resolved or fully investigated. In addition, as threats continue to evolve and increase, and as the regulatory environment related to information security, data collection and use, and privacy has become and continues to become more rigorous, we have been required, and expect to continue to need to, make investments to enhance our detection, monitoring, and mitigation processes and procedures, which could adversely impact our results of operations.

If we are unable to protect sensitive or confidential information from cybersecurity threats and attacks, our customers or governmental authorities could question the adequacy of our threat mitigation and detection processes and procedures and, as a result, our present and future business could be negatively impacted. Data privacy regulations, including but not limited to the General Data Protection Regulation (EU), Data Protection Act 2018 (UK), Law No. 09-08 (Morocco), and Personal Data Protection Act 2010 (Malaysia) (collectively, “Privacy Regulations”), impose a range of compliance obligations applicable to the collection, use, retention, security, processing, and transfer of personally identifiable information. Various U.S. states and other governmental authorities around the world have imposed or are considering similar types of laws and regulations, data breach reporting and penalties for non-compliance and increasing security requirements. These laws and regulations are broad in scope and are subject to evolving interpretation and we have in the past been, and in the future could be, required to incur substantial costs to monitor compliance or to alter our