XML 58 R38.htm IDEA: XBRL DOCUMENT
v3.25.3

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Sep. 27, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Our cybersecurity policies and reporting processes are designed so that members of our senior management receive timely and adequate information regarding cybersecurity matters that impact the Company, including threats and incident response. We have implemented an approach to assess, identify and manage cybersecurity risks within our overall enterprise risk management program that shares common methodologies, reporting channels and governance processes and is based on a recognized framework established by the National Institute of Standards and Technology. Cybersecurity risks, both internal and from third parties, are tracked regularly. We have established plans and procedures to guide us through an active threat or incident in order to return to normal business operations. We have developed a notification process to allow for real-time escalation of material cybersecurity incidents by and among members of our Corporate IT Security Team ("CIST"). In addition, our IT infrastructure management program maintains an IT Crisis Response Plan (“ICRP”) where we have disaster recovery plans for key applications. The ICRP includes processes which address disruption of services that affect any IT services supplied by third-party vendors or service providers. Our IT infrastructure management program also ensures an initial risk assessment is conducted on all new third-party vendors prior to engagement. We regularly complete periodic assessments and testing of our practices to address cybersecurity threats and incidents by performing internal audits of internal processes and controls. We engage third-party expertise and utilize threat intelligence feeds to supplement and enhance our CIST of cybersecurity professionals. In addition, we require all employees to take several mandatory cybersecurity training courses on an annual basis. In the ordinary course of our business, we have experienced and expect to continue to experience, cyber-based attacks and other attempts to compromise our information systems. Based on the information we have as of the date of this Annual Report on Form 10-K, we do not believe that any risks from any cybersecurity threats or from any previous cybersecurity incident have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, whether directly or through our supply chain or other channels, we face a risk of such threats, the consequences of which could be material. Further, the preventative actions we have taken and continue to take to reduce the risk of cybersecurity threats and incidents may not successfully protect against these potential threats and incidents in the future. While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. “Risk Factors” under the heading "We face, and may continue to face, risks related to information systems interruptions, intrusions and or new software implementations, which may adversely affect our business operations" for a discussion of cybersecurity risks.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our Board of Directors (“Board”) is informed about cybersecurity risk matters pertaining to the Company and its operations as part of our overall enterprise risk assessment. At least annually, or more frequently as necessary, the Board receives cybersecurity briefings and is apprised of cybersecurity incidents deemed to pose significant risk to us. Our internal controls and procedures are designed to provide for the identification, notification, escalation and communication of cybersecurity incidents to management, including when appropriate to the Board, so that decisions regarding public disclosure and reporting of such incidents can be made in a timely manner.
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | We also maintain an Executive Cyber Incident Escalation Team (“ECIET”), which consists of our Chief Executive Officer ("CEO"), Chief Financial Officer (“CFO”), Senior Vice President - General Counsel, Chief Information Officer (“CIO”) and the Chief Information Security Officer (“CISO”). The ECIET meets annually to practice and refine our processes through tabletop exercises simulating cyberattacks for incident response, management and escalation at both technical and executive levels in order to maintain readiness to respond and to identify any areas where improvements or updates to our cybersecurity infrastructure or procedures are required.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The CIST, led by our CISO, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes that protect, detect and respond in the defense of our data and enterprise computing systems and networks. The CIST is supported by experienced and knowledgeable leaders, who each have several decades of experience managing risk at Moog or similar companies, including risks arising from cybersecurity threats. The CIST consists of several centers of expertise comprised of persons with many types of skills and ability, including security operations center analysts, cyber engineers, threat hunters, threat modelers, cyber risk and compliance professionals, and threat and vulnerability management analysts. Members of the CIST maintain cybersecurity credentials, such as Certified Information Security Manager, Certified Information Systems Security Specialist, CompTIA Security+ and cybersecurity Analyst+, EC-Council Certified Ethical Hacker, Computer Hacking Forensic Investigator, and several vendor product certifications including from Amazon Web Services, Microsoft and Qualys.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | We also perform annual internal assessments and audits of internal processes and controls related to cybersecurity and engage third-party experts to support the assessment of cybersecurity related risks, including cybersecurity penetration testing. The results of these assessments, audits and tests are reported to the CIO and CFO. In the event of a cybersecurity incident, we engage our Incident Response Plan, which outlines the steps to be followed regarding preparation, detection, analysis, containment, eradication, recovery, notification, and post-incident remediation. Notification includes informing functional areas (e.g., legal), as well as senior management and the Board, as appropriate. We also have an insider threat detection program to proactively identify internal threats and mitigate those threats in a timely manner. As a defense contractor, we must comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement to adequately safeguard controlled unclassified information and reporting cybersecurity incidents to the Department of Defense’s Cybersecurity Maturity Model Certification program. Moog also shares and receives threat intelligence information with our defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations. The CISO and the CIO present cybersecurity updates regularly and, as necessary, to the CFO. The CFO will engage the Board to participate in assessing cybersecurity risk as part of the Company’s overall risk assessment. In addition, the Board is informed when a cybersecurity issue is identified that may pose significant risk to the Company.

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration