Company: MRCY
Filing Date: 2025-08-11
Form Type: 10-K
Source: 0001049521-25-000024
Chunk: 50

Company: MERCURY SYSTEMS INC
Filing Date: 2025-08-11
Form: 10-K
Item: Item 1C
Chunk 50
---
ITEM 1C.CYBERSECURITY

We assess and identify material risks from cybersecurity threats primarily through the work of our Chief Information Officer (“CIO”) as part of our enterprise risk management (“ERM”) process and through regularly scheduled meetings of our multidisciplinary cyber critical incident response team. The ERM process, administered by management with input from business leaders and our global and corporate functions, monitors material risks facing Mercury, including cybersecurity threats. Our CIO works directly with our CFO and other members of senior management to assess cybersecurity threats as part of the ERM process. Our CIO oversees the internal cybersecurity organization headed by our Chief Information Security Officer (our “Cybersecurity Team”).We could be negatively impacted by a security breach, through a cyber-attack, cyber intrusion, insider threat, supply chain incident, or other significant disruption of our IT networks and related systems. See “Item 1A - Risk Factors” in this Annual Report for a further discussion of specific risks related to cybersecurity threats. Our Cybersecurity Team monitors activity, scans applications and systems for vulnerabilities and risk from cybersecurity threats, and creates action plans to address and track identified cybersecurity threats until they have been remediated. Activities and cybersecurity incidents are reported to our cyber critical incident response team, and the CISO, who briefs our Compliance Committee, a dedicated committee of senior management focused on regulatory compliance. Our Cybersecurity Team also routinely engages with third parties, including government agencies focused on cyber resiliency, to manage risks from cybersecurity threats. For example, we are members of the DoD Defense Industrial Base Collaborative Information Sharing Environment, the National Defense Information Sharing and Analysis Center, and the National Security Agency Enduring Security Framework as well as Infragard, a partnership between the FBI and members of the private sector for the protection of U.S. critical infrastructure. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting, and recovering from cybersecurity threats.We maintain an insider threat program designed to identify, assess, and address potential internal risks from within our Company. Our program evaluates potential risks consistent with industry practices, customer requirements and applicable law, including privacy and other considerations. As a government contractor, we must comply with extensive cybersecurity regulations, including the Defense Federal Acquisition Regulation Supplement related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DoD. Our policies and implemented controls reflect our adherence to these requirements.Additionally, as part of our processes to manage risks related to a breach in our information systems, management requires employees to take cybersecurity trainings and