XML 214 R33.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Mar. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Cybersecurity oversight is embedded in our ERM Steering Committee, chaired by the Chief Operating Officer and including senior executives such as the Chief Information Security Officer (“CISO”) and Chief Information Officer (“CIO”). This committee is responsible for:
Identifying, assessing, and managing cybersecurity risks within the broader ERM framework;
Aligning cybersecurity risk management priorities and strategies with business objectives;
Monitoring periodic internal and third-party assessments, threat simulations, and security exercises to evaluate cybersecurity defenses; and
Addressing identified vulnerabilities through mitigation efforts and risk response strategies.
See “Item 1C. Cybersecurity—Governance—Management’s Responsibilities” below for additional information regarding our cybersecurity risk management program.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] As one of the world’s largest cybersecurity solution providers, we routinely defend against advanced persistent threats both internally and for our customers. Our cybersecurity risk management program is an integral part of our overall Enterprise Risk Management (“ERM”) program, and is designed to assess, identify, manage and mitigate internal and external cybersecurity risks, threats and incidents.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Our cybersecurity risk management program is led by our CISO, who is responsible for our information security strategy, policies, compliance, security architecture and engineering, security operations, and cybersecurity threat detection and response. Our CISO, a Certified Information Systems Security Professional (“CISSP”), has over 20 years of information security and program management experience and has served as the CISO for several large-scale enterprises in the U.S. government services industry, commercial organizations, and not-for-profit organizations.
As a government contractor, we are required to comply with extensive regulations and standards, including but not limited to, cybersecurity regulations and standards and the requirements of the DFARS. Additionally, our cybersecurity risk management program is guided by the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework. Our policies and implemented controls have been assessed by external organizations, including industry partners and the federal government. We work closely with our subcontractors and suppliers to identify and manage cybersecurity risks and, as appropriate, require them to comply with applicable laws and regulations. These contractual requirements include the requirement that our subcontractors implement certain security controls, and that our subcontractors self-report the status of their implementation of these controls to the U.S. government.
To manage cybersecurity risk introduced from our supply chain, depending on the nature of a supplier's work and the sensitivity of our and our customers’ information provided to the supplier, we also require suppliers to complete our security questionnaire and provide evidence of security accreditations, and we evaluate supplier compliance with security requirements using internal and third-party resources.
Our CISO also leads our Cyber Fusion Center (“CFC”), whose function is, pursuant to our Cyber Incident Response Plan, to stay apprised of existing and emerging cybersecurity threats and monitor our information systems to proactively identify, protect against, and mitigate cybersecurity threats. The CFC uses intelligence collected from various sources, fused with intelligence collected from analysis and response actions, to proactively search for and address adversary activity against our information systems. The CFC possesses in-depth knowledge of network, endpoint, perimeter security systems, identity-based vulnerabilities, data protection, threat intelligence, forensics, penetration testing, and malware reverse engineering, as well as the functioning of specific applications or underlying information systems infrastructure. The CFC partners with a third party managed systems security provider (“MSSP”) to augment 24x7 cyber incident monitoring.
The Cyber Incident Response Team (“CIRT”) is responsible for the incident response process and provides direction and guidance to users of our information systems when responding to cybersecurity incidents. The CIRT also provides intrusion monitoring of networks and information systems, and performs triage and analysis of events to identify and respond to potential incidents, including potential incidents occurring on third-party systems. The CIRT categorizes anomalous cybersecurity events into discrete levels in which cybersecurity events are escalated to appropriate levels of management, as well as our Crisis Management Team, Cyber Incident Materiality Committee, Audit Committee, and Board, based on the severity of the incident. While typical cybersecurity management and incident response is provided by internal resources, we have arrangements with certain third parties whom we can engage if additional support or resources are required.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Our cybersecurity risk management program is led by our CISO, who is responsible for our information security strategy, policies, compliance, security architecture and engineering, security operations, and cybersecurity threat detection and response.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Board oversees the Company’s risk management processes, including those relevant to cybersecurity risks, and the Audit Committee provides focused governance of cybersecurity, ensuring that cybersecurity threats, vulnerabilities, and incident response measures are continuously assessed and managed.
Cybersecurity Risk Role of Management [Text Block]
The Board oversees the Company’s risk management processes, including those relevant to cybersecurity risks, and the Audit Committee provides focused governance of cybersecurity, ensuring that cybersecurity threats, vulnerabilities, and incident response measures are continuously assessed and managed. The Audit Committee receives regular briefings from the CISO on risks related to internal systems, third-party relationships, and emerging cybersecurity threats. The Audit Committee provides updates to the Board on significant cybersecurity risks and the Company’s mitigation strategies.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] Our CISO also leads our Cyber Fusion Center (“CFC”), whose function is, pursuant to our Cyber Incident Response Plan, to stay apprised of existing and emerging cybersecurity threats and monitor our information systems to proactively identify, protect against, and mitigate cybersecurity threats.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our CISO, a Certified Information Systems Security Professional (“CISSP”), has over 20 years of information security and program management experience and has served as the CISO for several large-scale enterprises in the U.S. government services industry, commercial organizations, and not-for-profit organizations.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] The Audit Committee receives regular briefings from the CISO on risks related to internal systems, third-party relationships, and emerging cybersecurity threats. The Audit Committee provides updates to the Board on significant cybersecurity risks and the Company’s mitigation strategies.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true