Company: SPR
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0001628280-25-009088
Chunk: 102

Company: Spirit AeroSystems Holdings, Inc.
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1C
Chunk 102
---
 Response Policy specifies ownership and timing of key actions and prescribes the engagement of functional leaders, senior Executives, and the Board of Directors, depending on the incident. We have developed playbooks to guide specific actions related to different incident types. Finally, we have a cyber insurance policy underwritten by a global leader in commercial insurance solutions.

Part of our Enterprise Risk Management program involves understanding risks that third parties, including our supply chain partners, introduce to our organization. Our GIS organization has a formal risk assessment process that evaluates the cybersecurity risk of third party “as-a-service” providers, particularly in situations where we share confidential or sensitive information, or in situations where our compliance status or operations may be impacted through a cybersecurity incident.

Cybersecurity Governance

The Board of Directors’ Risk Committee has the responsibility for oversight of our cybersecurity program. This committee’s membership includes subject matter experts in both cybersecurity and national security. Spirit’s CISO reports to the Risk Committee quarterly or as needed on the state of our cybersecurity program.

Cybersecurity Risks

To date, we are not aware of risks from cybersecurity threats, including as a result of any previous known cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, we are subject to various cybersecurity risks, and we have experienced cyber-attacks, and routinely experience cybersecurity threats and attempts to gain access to sensitive information, as do our customers, suppliers, and other third parties with which we work. We cannot provide assurance that our processes and procedures will be sufficient to anticipate, detect, recognize or prevent cybersecurity threats. For more information about the cybersecurity risks we face, see Item 1A. “Risk Factors – Risks Related to Our Operations”