Company: NOC
Filing Date: 2025-01-30
Form Type: 10-K
Source: 0001133421-25-000006
Chunk: 58

Company: NORTHROP GRUMMAN CORP /DE/
Filing Date: 2025-01-30
Form: 10-K
Item: Item 1A
Chunk 58
---
 unable to obtain indemnification or we may be required to indemnify Vista. 

•Cyber and other security threats or disruptions could have a material adverse effect on our reputation and our financial position, results of operations and/or cash flows.

As a defense contractor, we face significant cyber and other security threats. They include, among other things, attempts to gain unauthorized access to sensitive information or otherwise compromise the integrity, confidentiality and/or availability of our systems, hardware and networks, and the information on them; insider threats; ransomware; threats to the safety of our directors, officers and employees; threats to our facilities, infrastructure, products (we produce and use), and subcontractors or other suppliers (referred to inclusively as suppliers); and threats from terrorist acts, espionage, civil unrest and other acts of aggression. We are also subject to increasing government, customer and other cyber and security requirements, including disclosure obligations.

Cyber threats, both on premises and in the cloud, are complex, continuous and evolving and include, but are not limited to: malicious software, destructive malware, ransomware, targeting by more advanced and persistent 

-14-

NORTHROP GRUMMAN CORPORATION

adversaries, including nation states and other actors, zero-day attacks, attempts to gain unauthorized access to systems or data, disruption to operations, critical systems or denial of service attacks; unauthorized release of confidential, personal or other protected information (ours or that of our employees, customers or partners); corruption of data, networks or systems; harm to individuals; and loss of assets. We have been and could be impacted by cyber threats or other disruptions or vulnerabilities found in products or services we use or in our internal, partners’ or customers’ systems that are used in connection with our business. Further, the sophistication, availability and use of artificial intelligence by threat actors present an increased level of risk. We have experienced cyber attacks and, due to the evolving threat landscape, expect we will continue to experience additional attacks in the future. The various measures and controls we have implemented to monitor and mitigate risks associated with these threats and to increase the cyber resiliency of our infrastructure and products may not always be sufficient or fully effective, particularly against previously unknown vulnerabilities, including those that could go undetected for an extended period.

Cyber events have caused and could cause us harm and require us to undertake remedial actions. Successful attacks can lead to losses or misuse of sensitive information or capabilities; theft or corruption of data; harm to personnel, infrastructure or products; protracted disruptions in our