Company: NOC
Filing Date: 2025-01-30
Form Type: 10-K
Source: 0001133421-25-000006
Chunk: 71

Company: NORTHROP GRUMMAN CORP /DE/
Filing Date: 2025-01-30
Form: 10-K
Item: Item 1C
Chunk 71
---
Item 1C. Cybersecurity

We recognize the critical importance of maintaining the safety and security of our systems and data and have a holistic process for overseeing and managing cybersecurity and related risks. This process is supported by both management and our Board of Directors.

In 2024, our global cybersecurity function was maintained in our Chief Information Office, led by our Chief Information Officer (CIO), who reported to our CEO. In 2025, we have brought together our chief information and digital transformation offices into a newly formed Chief Information and Digital Office, led by our Chief Information and Digital Officer (CIDO), who reports to the CEO. The Chief Information Security Officer (CISO), who previously reported to the CIO, now reports to the CIDO and continues to lead our cybersecurity functions. The CISO is responsible for the assessment and management of cybersecurity risk and the resiliency, protection and defense of our networks and systems. The CISO leads a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, data protection, privacy, insider threats and regulatory compliance. The current CISO is an executive with extensive technical and operational experience in building and leading cybersecurity and resiliency teams in the industry and government. 

Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The full Board receives an update on the company’s risk management process and the risk trends related to cybersecurity at least annually. The Audit and Risk Committee specifically assists the Board in its oversight of risks related to cybersecurity. To help ensure effective oversight, the CISO briefs the Audit and Risk Committee on the company’s information security and cybersecurity risk posture at least four times a year.In addition, the company’s Enterprise Risk Management Council (ERMC) considers risks relating to cybersecurity, among other significant risks, and applicable mitigation plans to address such risks. The ERMC is comprised of the Executive Leadership Team, as well as the Chief Accounting Officer, Chief Ethics and Compliance Officer, Corporate Secretary, Chief Sustainability Officer, Treasurer and Vice President, Internal Audit. The CISO and the CIDO (previously the CIO) attend each ERMC meeting. The ERMC meets during the year and receives periodic updates from the CIDO and CISO on cybersecurity risks. We have an established process governing our response to a cybersecurity incident from detection to mitigation, recovery, assessment, internal and external notifications