Company: BWXT
Filing Date: 2025-03-19
Form Type: 10-K/A
Source: 0001486957-25-000015
Chunk: 51

Company: BWX Technologies, Inc.
Filing Date: 2025-03-19
Form: 10-K/A
Chunk 51
---
 systems and the Certified Information Systems Security Professional (CISSP) and Information Systems Security Architecture Professional (ISSAP) certifications, as well as over 30 years of experience as an information technology professional with the most recent 15 years specializing in cybersecurity.

The CIMT is responsible for coordinating the containment, response, investigation, reporting and recovery related to a cybersecurity incident, and is an internally led management team made up of leaders from our Communications, Human Resources, IT and Cybersecurity, Legal and Compliance, Risk Management and other departments, including our IT Director, Cyber Security. Team members possess a broad scope of expertise, including cybersecurity, information technology, legal, compliance, risk management, insurance and crisis communications. The CIMT operates under the co-leadership of the General Counsel and CDO, who are responsible for oversight and composition of the CIMT, determining whether an incident warrants activating external service providers, providing updates to the Chief Executive Officer and senior management team, keeping our Governance Committee as well as our Board of Directors informed as appropriate, and ultimately establishing and executing our enterprise-wide incident response strategy.

Training and preparation are essential to the overall success of the CIMT to help ensure team members develop and maintain the operational, technical and managerial skillsets necessary to support the effective function of the CIMT. Our CIMT members undergo training and preparation for cybersecurity incidents like participating in regular cybersecurity incident response tabletop exercises and reviewing lessons learned. Our general cybersecurity team receives extensive on-the-job training with respect to cybersecurity operations, maintenance, analysis, detection, investigation, mitigation and protection. In addition, company-wide cybersecurity and insider threat training is mandated for our employees.

We have processes and controls that oversee, identify and manage cybersecurity risks with respect to our external service providers, including cybersecurity service providers. For example, we review and seek to negotiate terms and conditions in our legal agreements to provide for the adequate protection of confidential information and the Company’s networks and systems and compliance with any applicable cybersecurity requirements, including with respect to any information exchanged. We also review the security controls of hosted solutions in an effort to ensure protection is commensurate with our security requirements. We periodically revalidate those cybersecurity control reviews commensurate with the risk identified. Further, we utilize an external security assessment service to produce security ratings that include detailed descriptions of deficiencies affecting the rating. We seek to respond accordingly to those deficiencies to the extent practicable. Lastly, as appropriate and when feasible, we may visit our service providers’ facilities to observe security practices and physical security controls.

Despite taking extensive precautions, cybersecurity incidents