Company: SPR
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001628280-25-009088
Chunk: 101

Company: Spirit AeroSystems Holdings, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 101
---
Item 1C.  Cybersecurity

Cybersecurity Program

Our cybersecurity program is designed to detect known and anticipated threats, and contemplate various types of unexpected but possible threats. We have developed processes designed to identify, assess, mitigate, analyze and respond to threats, and continue to mature our cyber resiliency solutions. 

We continuously monitor the cybersecurity landscape and identify active and potential threats through a combination of tools and processes. Our Global Information Security (“GIS”) team has day-to-day responsibility for Spirit’s cybersecurity program. This group is led by our Chief Information Security Officer (“CISO”), who has more than twenty years of relevant audit and cybersecurity experience. The CISO collaborates across the business, participates in internal audits, and is active in several leading industry groups to help benchmark our efforts with third parties. GIS receives and analyzes information from various resources to inform our cybersecurity program needs. An Executive Security Council comprised of senior leaders across the business meets regularly to discuss the company’s overall cybersecurity strategy, policies, and key cyber risks and 

37

Table of Contents

mitigations. Significant risks are escalated to the Enterprise Risk Council which is chaired by our President and CEO, who was the Deputy Secretary of Defense during the development of the 2018 Department of Defense Cyber Strategy. We implement appropriate controls to help protect our information or information we have control of on our systems, and our operations. We evaluate our controls and systems against industry-recognized standards, and contractual requirements, as applicable.

The CISO monitors and reviews our process of patching compliance, which is managed and executed via a combination of internal resources and third-party service providers. We also use third parties to supplement monitoring of cyber activity and for various special projects, which may include projects related to cybersecurity. 

As part of our cybersecurity risk management program, we have planned “tabletop” exercises designed to simulate various cybersecurity threats or intrusions and help identify gaps in our preparedness, and help provide clarity in how to respond to any potential incidents. These exercises are designed to test the working level and senior leadership level, including participation by Executive leaders. All employees are required to take mandatory cybersecurity training courses throughout the year. We execute simulated phishing exercises for all employees monthly and provide direct feedback to employees who fail such simulations to help them understand how to recognize phishing attempts. Our overall program is designed to help us prevent and effectively respond to cybersecurity incidents. 

GIS maintains an Incident Management and Response Policy that provides a classification framework for cybersecurity incidents and defines critical roles and responsibilities during a cybersecurity incident. The Incident