Company: GE
Filing Date: 2025-02-03
Form Type: 10-K
Source: 0000040545-25-000015
Chunk: 37

Company: GENERAL ELECTRIC CO
Filing Date: 2025-02-03
Form: 10-K
Item: Item 7
Chunk 37
---
.•Training: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities. We also provide additional role-based training to some employees based on customer requirements, regulatory obligations and industry risks.•Supplier risk assessments: We have implemented a third-party risk management process that includes expectations regarding information and cybersecurity. That process, among other things, provides for GE Aerospace to perform cybersecurity assessments on certain suppliers based on an assessment of their risk profile and a related rating process. GE Aerospace also seeks contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect any GE Aerospace information and network access that is provided to them.•Third-party assessments of GE Aerospace: We have third-party cybersecurity companies engaged to periodically assess GE Aerospace’s cybersecurity posture, to assist in identifying and remediating risks from cybersecurity threats.  We also consider cybersecurity, along with other top risks for GE Aerospace, within our enterprise risk management framework. The enterprise risk management framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. We face certain ongoing risks from cybersecurity threats—including heightened threats in connection with the separation of GE HealthCare and GE Vernova—that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, financial condition or cash flows. Refer to the Risk Factors section (Cybersecurity - Increased cybersecurity requirements, vulnerabilities, threats and more sophisticated and targeted computer crime, as well as cybersecurity failures, pose risk to our systems, networks, products, solutions, services and data.) for additional information about these risks.

CYBERSECURITY GOVERNANCE. The Audit Committee of the GE Aerospace Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee reports back to the full Board about this and other areas within its responsibility. As part of its oversight role, the Audit Committee receives reporting about GE Aerospace’s practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates from GE Aerospace’s Chief Information Officer (CIO) and Chief Information Security Officer (CISO) on cyber threats and our cybersecurity risk management strategy. The Audit Committee also receives information about cybersecurity risks as part of GE Aerospace’s enterprise risk management