Booz Allen Hamilton Holding Corp

Previous wording

•changes in U.S. government spending and mission priorities, including due to uncertainty relating to the new presidential administration, funding of the U.S. government, and increasing the debt ceiling;

Current wording

•changes in U.S. government spending and mission priorities, including due to uncertainty relating to the funding of the U.S. government and increasing the debt ceiling;

Previous wording

•our ability to compete effectively in the competitive bidding and re-competing processes and delays or losses of contract awards caused by competitors’ protests of major contract awards received by us;

Current wording

•our ability to compete effectively in the competitive bidding and re-competing processes, including increasing competition from non-traditional contractors and changes in government procurement practices, and delays or losses of contract awards caused by competitors’ protests of major contract awards received by us;

Previous wording

•risks related to the deterioration of economic conditions or weakening in the credit or capital markets;

Current wording

•risks related to the deterioration of economic conditions or weakening in the credit or capital markets, including financial institution instability that could impair access to our funds and adversely affect our liquidity;

Previous wording

•internal system or service failures and security breaches, including, but not limited to, those resulting from external or internal threats, including cyber attacks on our network and internal systems, or on our customers’ network or internal systems;

Current wording

•internal system or service failures and security breaches, including, but not limited to, those resulting from external or internal threats, including cyber-attacks on our network and internal systems, or on our customers’ network or internal systems, including more frequent and sophisticated threats such as those by bad actors looking to augment traditional cyber tools and tradecraft with artificial intelligence capabilities;

Previous wording

•misconduct or other improper activities from our employees, subcontractors, or suppliers, including the improper access, use, or release of our or our customers’ sensitive or classified information;

Current wording

•misconduct or other improper activities from our employees, subcontractors, or suppliers, including the improper access, use, or release of our or our customers’ sensitive, classified, or export-controlled information;

Previous wording

•risks related to completed and future acquisitions, including our ability to realize the expected benefits from such acquisitions.

Current wording

•risks related to completed and future acquisitions, joint ventures or investments, including our ability to realize the expected benefits from such transactions.

Previous wording

•the adoption by the U.S. government of new laws, rules, and regulations, such as those relating to organizational conflicts of interest issues or limits;

Current wording

•the adoption by the U.S. government of new laws, rules, and regulations, new interpretations or enforcement priorities relating to existing laws, and changes in procurement practices;

Previous wording

The U.S. government is our primary customer, with revenue from contracts and task orders, either as a prime or a subcontractor, with U.S. government agencies accounting for 98% of our revenue for fiscal year 2025. Our belief is that the successful future growth of our business will continue to depend primarily on our ability to be awarded work under U.S. government contracts, as we expect this will continue to be the primary source of substantially all of our revenue. For this reason, any issue that compromises our relationship with the U.S. government generally or any U.S. government agency that we serve would cause our revenue to decline. Among the key factors in maintaining our relationship with U.S. government agencies is our performance on contracts and task orders, the strength of our professional reputation, compliance with applicable laws and regulations, and the strength of our relationships with customer personnel.

Current wording

The U.S. government is our primary customer. We expect to continue to derive the vast majority of our revenue from work performed under U.S. government contracts. For this reason, any issue that compromises our relationship with the U.S. government generally or any U.S. government agency that we serve would cause our revenue to decline. Among the key factors in maintaining our relationship with U.S. government agencies is our performance on contracts and task orders, the strength of our professional reputation, compliance with applicable laws and regulations, and the strength of our relationships with customer personnel.

Previous wording

Our relationship with U.S. government agencies could be harmed by the mishandling or the perception of mishandling of sensitive information, such as our failure to maintain the confidentiality of the existence of our business relationships with certain of our customers, including as a result of misconduct or other improper activities by our employees, subcontractors, or suppliers, or a failure to maintain adequate protection against security breaches, including those resulting from cyber attacks. See “—Our employees or subcontractors may engage in misconduct or other improper activities, which could harm our ability to conduct business with the U.S. government.” Our relationship with the U.S. government could also be damaged as a result of an agency’s dissatisfaction with work performed by us, a subcontractor, or other third parties who provide services or products for a specific project for any reason, including due to perceived or actual deficiencies in the performance or quality of our work, and we may incur additional costs to address any such situation and the profitability of that work might be impaired. In addition, to the extent our performance under a contract does not meet a U.S. government agency’s expectations, the customer might seek to terminate the contract prior to its scheduled expiration date, provide a negative assessment of our performance to government-maintained contractor past-performance data repositories, fail to award us additional business under existing contracts or otherwise, and direct future business to our competitors.

Current wording

Our relationship with U.S. government agencies could be harmed by the mishandling or the perception of mishandling of sensitive information, such as our failure to maintain the confidentiality of the existence of our business relationships with certain of our customers, including as a result of misconduct or other improper activities by our employees, subcontractors, or suppliers, or a failure to maintain adequate protection against security breaches, including those resulting from cyber-attacks. Our relationship with the U.S. government could also be damaged as a result of an agency’s dissatisfaction with work performed by us, a subcontractor, or other third parties who provide services or products for a specific project for any reason, including due to perceived or actual deficiencies in the performance or quality of our work, and we may incur additional costs to address any such situation and the profitability of that work might be impaired. In addition, to the extent our performance under a contract does not meet a U.S. government agency’s expectations, the customer might seek to terminate the contract prior to its scheduled expiration date, provide a negative assessment of our performance to government-maintained contractor past-performance data repositories, fail to award us additional business under existing contracts or otherwise, and direct future business to our competitors.

Previous wording

Further, negative publicity concerning government contractors in general, or us, regardless of accuracy, may harm our reputation among federal agencies and federal government contractors, and the credibility of our brand, and adversely affect our ability to attract or retain customers or talent. There has been increased publicity regarding government contractors in general, and including the Company, in connection with the U.S. government’s efforts to improve efficiency and reduce costs, which could harm our reputation and could have a material impact on our business, results of operations and financial condition. Due to the sensitive nature of our work and our confidentiality obligations to our customers, we may be unable or limited in our ability to respond to such negative publicity, which could also harm our reputation and business. To the extent our reputation or relationships with U.S. government agencies is impaired, our revenue and operating profits could materially decline.

Current wording

Further, negative publicity concerning government contractors in general, or us, our business practices, or our products and services, regardless of accuracy or completeness, may harm our reputation among federal agencies and federal government contractors, and the credibility of our brand, and adversely affect our ability to attract or retain customers or talent. Due to the sensitive nature of our work and our confidentiality obligations to our customers, we may be unable or limited in our ability to respond to such negative publicity, which could also harm our reputation and business. To the extent our reputation or relationships with U.S. government agencies is impaired, our revenue and operating profits could materially decline.

Previous wording

•budgetary constraints, including mandated automatic spending cuts, affecting U.S. government spending generally, or specific agencies in particular, and changes in available funding;

Current wording

•U.S. government budget deficits and budgetary constraints, including mandated automatic spending cuts, affecting U.S. government spending generally, or specific agencies in particular, and changes in available funding;

Previous wording

•reduced U.S. government outsourcing of functions that we are currently contracted to provide, including as a result of increased insourcing by various U.S. government agencies due to changes in the definition of “inherently governmental” work, including proposals to limit contractor access to sensitive or classified information and work assignments;

Current wording

•reduced U.S. government outsourcing of functions that we are currently contracted to provide, including as a result of increased insourcing by various U.S. government agencies;

Previous wording

•a shift in expenditures away from agencies or programs that we support;

Current wording

•a shift in expenditures away from U.S. government agencies or programs that we support, including changes or delays in such programs, shifts in the scope of work, or shifts away from the federal government to state and local governments, or away from government contractors, in general, or from us;

Previous wording

•delays in the payment of our invoices by government payment offices;

Current wording

•delays in the U.S. government contract procurement process or in the payment of our invoices by government payment offices; and

Previous wording

•an inability by the U.S. government to fund its operations as a result of a failure to increase the U.S. government’s debt ceiling, the exhaustion of “extraordinary measures” to borrow additional funds without breaching the government’s debt ceiling, a credit downgrade of U.S. government obligations or for any other reason; and

Current wording

•an inability by the U.S. government to fund its operations as a result of a failure to increase the U.S. government’s debt ceiling, the exhaustion of “extraordinary measures” to borrow additional funds without breaching the government’s debt ceiling, a credit downgrade of U.S. government obligations or for any other reason.

Previous wording

In addition, any disruption in the functioning of U.S. government agencies, including as a result of U.S. government closures and shutdowns, terrorism, war, international conflicts (including the ongoing conflict between Russia and Ukraine, ongoing conflicts in the Middle East, and increased tensions in Asia), trade tensions related to recent shifts in international trade policies, natural disasters, public health crises, destruction of U.S. government facilities, and other potential calamities could have a negative impact on our operations and cause us to lose revenue or incur additional costs due to, among other things, our inability to deploy our staff to customer locations or facilities as a result of such disruptions.

Current wording

In addition, any disruption in the functioning of U.S. government agencies, including as a result of U.S. government closures and shutdowns, terrorism, war, foreign conflicts, trade tensions related to international trade policies, under-staffing or layoffs within the government, natural disasters, public health crises, destruction of U.S. government facilities, and other potential calamities could have a negative impact on our operations and cause us to lose revenue or incur additional costs due to, among other things, our inability to deploy our staff to customer locations or facilities as a result of such disruptions.

Previous wording

If government funding relating to our contracts with the U.S. government or Department of Defense becomes unavailable, or is reduced or delayed, or planned orders are reduced, our contract or subcontract under such programs may be terminated or adjusted by the U.S. government or the prime contractor, if applicable. Our operating results could also be adversely affected by spending caps or changes in the budgetary priorities of the U.S. government or Department of Defense, as well as delays in program starts or the award of contracts or task orders under contracts.

Current wording

If government funding relating to our contracts with the U.S. government becomes unavailable, or is reduced or delayed, or planned orders are reduced, our contracts or subcontracts under such programs may be terminated or adjusted by the U.S. government or the prime contractor, if applicable. Our operating results could also be adversely affected by spending caps or changes in the budgetary priorities of the U.S. government or Department of War, as well as delays in program starts or the award of contracts or task orders under contracts.

Previous wording

In circumstances where contracts are held by other companies and are scheduled to expire, we still may not be provided the opportunity to bid on those contracts if the U.S. government determines to extend the existing contract. If we are unable to win particular contracts that are awarded through the competitive bidding and re-competing processes, we may not be able to operate in the market for services that are provided under those contracts for the duration of those contracts to the extent that there is no additional demand for such services. An inability to consistently win new contract awards over any extended period would have a material adverse effect on our business and results of operations.

Current wording

In circumstances where contracts are held by other companies and are scheduled to expire, we still may not be provided the opportunity to bid or otherwise compete on those contracts if the U.S. government determines to extend the existing contract. If we are unable to win particular contracts that are awarded through the competitive bidding and re-competing processes, we may not be able to enter, operate, or expand in the markets for the services that are provided under those contracts for the duration of those contracts to the extent that there is no additional demand for such services. An inability to consistently win new contract awards over any extended period would have a material adverse effect on our business and results of operations.

Previous wording

We have seen our current competitive environment result in delays in procurements generally as well as an increase in the number of bid protests from unsuccessful bidders on new program awards. It can take many months for the relevant U.S. government agency to resolve protests by one or more of our competitors of contract awards we receive. Bid protests may result in significant expense to us, contract modification, or loss of an awarded contract as a result of the award being overturned. Even where we do not lose the awarded contract, the resulting delay in the startup and funding of the work under these contracts may cause our actual results to differ materially and adversely from those anticipated. There can be no assurance that these delays will not ultimately have a material adverse impact on our business and financial performance.

Current wording

In the current environment, we have seen delays in procurements generally as well as an overall decline in the number of bid protests from unsuccessful bidders on our new program awards. It can take many months for the relevant U.S. government agency to resolve protests by one or more of our competitors of contract awards we receive. Bid protests may result in significant expense to us, contract modification, or loss of an awarded contract as a result of the award being overturned. Even where we do not lose the awarded contract, the resulting delay in the startup and funding of the work under these contracts may cause our actual results to differ materially and adversely from those anticipated. There can be no assurance that these delays will not ultimately have a material adverse impact on our business and financial performance. While the National Defense Authorization Act (NDAA) for fiscal year 2026 contained provisions intended to curb protests by incumbent contractors, it remains too early to predict the impact such provisions will have upon protest rates.

Previous wording

We believe that one of the key elements of our success is our position as the holder of 2,596 active task orders under IDIQ contract vehicles as of March 31, 2025.

Current wording

We believe that one of the key elements of our success is our position as the holder of 2,426 active task orders under IDIQ contract vehicles as of March 31, 2026.

Previous wording

Under fixed-price contracts, we perform specific tasks or deliver a specific outcome for a predetermined price. Compared to time-and-materials and cost-reimbursable contracts, fixed-price contracts generally offer higher margin opportunities because we receive the benefits of any cost savings, but involve greater financial risk because we bear the impact of any cost overruns. The U.S. government has generally indicated that it intends to increase its use of fixed price contract procurements. We have seen a recent preference for the use of fixed price contracts with the new presidential administration, which may result in future contract modifications and conversions of existing contracts to fixed-price contracts. Because we assume the risk for cost overruns and contingent losses on fixed-price contracts, an increase in the percentage of fixed-price contracts in our contract mix would increase our risk of suffering losses.

Current wording

Under fixed-price contracts, we perform specific tasks or deliver a specific outcome for a predetermined price. Compared to time-and-materials and cost-reimbursable contracts, fixed-price contracts generally offer higher margin opportunities because we receive the benefits of any cost savings, but involve greater financial risk because we bear the impact of any cost overruns. The U.S. government, through the recent executive order “Promoting Efficiency, Accountability, and Performance in Federal Contracting,” directs federal agencies, subject to certain exceptions, to increase the use of firm-fixed price contracts for new awards to the maximum extent consistent with law. Additionally, agencies are directed, to the maximum extent practicable and consistent with law, to seek to modify, restructure, or renegotiate, their top ten highest-dollar-value contracts issued on an other-than-fixed price basis. This executive order may result in future contract modifications and conversions of existing contracts to fixed-price contracts. Because we assume the risk for cost overruns and contingent losses on fixed-price contracts, an increase in the percentage of fixed-price contracts in our contract mix may increase our risk of incurring losses.

Previous wording

Additionally, our profits could be adversely affected if our costs under any such contract exceed the assumptions we used in bidding for the contract. For example, we may miscalculate the costs, resources, or time needed to complete projects or meet contractual milestones as a result of delays on a particular project, including delays in designs, engineering information, or materials provided by the customer or a third party, delays or difficulties in equipment and material delivery, schedule changes, and other factors, some of which are beyond our control. We record provisions in our consolidated financial statements for losses on our contracts when necessary, as required under accounting principles generally accepted in the United States, or GAAP, but our contract loss provisions may not be adequate to cover all actual losses that we may incur in the future.

Current wording

Additionally, our profits could be adversely affected if our costs under any contract exceed the assumptions we used in bidding for the contract. For example, we may miscalculate the costs, resources, or time needed to complete projects or meet contractual milestones as a result of delays on a particular project, including delays in designs, engineering information, or materials provided by the customer or a third party, delays or difficulties in equipment and material delivery, schedule changes, and other factors, some of which are beyond our control. Additionally, as more contracts with the U.S. government transition to fixed-price, we face greater risk of cost overruns due to ambiguities in the contract itself regarding delineation of responsibilities between us and the U.S. government and uncertainty with how the government may manage the contract in practice. We record provisions in our consolidated financial statements for losses on our contracts when necessary, as required under accounting principles generally accepted in the United States, or GAAP, but our contract loss provisions may not be adequate to cover all actual losses that we may incur in the future.

Previous wording

We historically have not realized all of the revenue included in our total backlog, and we may not realize all of the revenue included in our current or future total backlog. There is a higher degree of risk in this regard with respect to unfunded backlog and priced options. In addition, there can be no assurance that our backlog will result in actual revenue in any particular period. This is because the actual receipt, timing, and amount of revenue under contracts included in backlog are subject to various contingencies, including congressional appropriations, many of which are beyond our control. The actual receipt of revenue from contracts included in backlog may never occur or may be delayed because: a program schedule could change or the program could be canceled; a contract’s funding or scope could be reduced, modified, delayed, de-obligated, or terminated early, including as a result of a lack of appropriated funds or cost cutting initiatives and other efforts to reduce U.S. government spending and/or the automatic federal defense spending cuts required by sequestration; in the case of funded backlog, the period of performance for the contract has expired or the U.S. government has exercised its unilateral right to cancel multi-year contracts and related orders or terminate existing contracts for convenience or default; in the case of unfunded backlog, funding may not be available; or, in the case of priced options, our customers may not exercise their options.

Current wording

We historically have not realized all of the revenue included in our total backlog, and we may not realize all of the revenue included in our current or future total backlog. There is a higher degree of risk in this regard with respect to unfunded backlog and priced options. In addition, there can be no assurance that our backlog will result in actual revenue in any particular period, because the actual receipt, timing, and amount of revenue under contracts included in backlog are subject to various contingencies, including congressional appropriations, many of which are beyond our control. The actual receipt of revenue from contracts included in backlog may never occur or may be delayed because: a program schedule could change or the program could be canceled; a contract’s funding or scope could be reduced, modified, delayed, de-obligated, or terminated early; in the case of funded backlog, the period of performance for the contract has expired or the U.S. government has exercised its unilateral right to cancel multi-year contracts and related orders or terminate existing contracts for convenience or default; in the case of unfunded backlog, funding may not be available; or, in the case of priced options, our customers may not exercise their options.

Previous wording

Any inability to hire additional appropriately qualified personnel or failure to timely and effectively deploy such additional personnel against funded backlog could negatively affect our ability to grow our revenue. We may also not recognize revenue on funded backlog due to, among other reasons, the tardy submissions of invoices by our subcontractors and the expiration of the relevant appropriated funding in accordance with a predetermined expiration date such as the end of the U.S. government's fiscal year. The amount of our funded backlog is also subject to change, due to, among other factors: changes in congressional appropriations that reflect changes in U.S. government policies or priorities resulting from various military, political, economic, or international developments; changes in the use of U.S. government contracting vehicles, and the provisions therein used to procure our services; and adjustments to the scope of services under, or cancellation of contracts, by the U.S. government at any time. As a result of the U.S. government’s review of federal spending across U.S. government agencies, we have had, and may in the future have, certain of our contracts impacted, reduced or canceled as a result of these reviews, which has reduced the amount of our total backlog and could have a material adverse impact on our business and financial performance. Furthermore, even if our backlog results in revenue, the contracts may not be profitable.

Current wording

Any inability to hire additional appropriately qualified personnel or failure to timely and effectively deploy such additional personnel against funded backlog could negatively affect our ability to grow our revenue. We may also not recognize revenue on funded backlog due to, among other reasons, the tardy submissions of invoices by our subcontractors and the expiration of the relevant appropriated funding. The amount of our funded backlog is also subject to change, due to, among other factors: changes in congressional appropriations; changes in the use of U.S. government contracting vehicles, and the provisions therein used to procure our services; and adjustments to the scope of services under our contracts, or cancellation of contracts, by the U.S. government at any time. As a result of the U.S. government’s review of federal spending across U.S. government agencies, we have had certain of our contracts impacted, reduced or canceled as a result of these reviews, which has reduced the amount of our total backlog and could have a material adverse impact on our business and financial performance. Furthermore, even if our backlog results in revenue, the contracts may not be profitable.

Previous wording

We create, implement, integrate, and maintain information technology (“IT”) systems that (a) are often mission critical, (b) regularly involve sensitive information, (c) may be deployed within war zones or other hazardous environments, and/or (d) can include information whose confidentiality is protected by law or contract. Additionally, we maintain internal systems housing sensitive employee and confidential company data. As a result, our systems and IT work products are susceptible to systems or service failures resulting from technical complexity, failures of third-party service providers, natural disasters, power shortages, insider threats (including improper access to the Company’s, customers’ or third parties’ information or resources, employee error, or malfeasance), terrorist attacks, physical or electronic security breaches, cyber attacks, computer viruses, or similar events or disruptions. Our systems and IT work product are the target of constantly evolving cyber attack vectors, including malware, social engineering, denial-of-service attacks, malicious software programs, phishing, smishing, vishing, identity spoofing (including through the use of emerging technologies such as “deep fakes”), account takeovers, and other cyber attacks fueled by emerging technologies, such as artificial intelligence. We have observed an increase in the frequency and sophistication of the cyber and security threats these systems face, with attacks that are more advanced and persistent, targeting us because we hold classified, controlled unclassified, and other sensitive information. As a result, we and our vendors face a heightened risk of a security breach or disruption resulting from an attack by computer hackers, persons with access to systems inside our organization, foreign governments, and cyber terrorists.

Current wording

We create, implement, integrate, and maintain information technology (“IT”) systems that (a) are often mission critical, (b) regularly involve sensitive information, (c) may be deployed within war zones or other hazardous environments, and/or (d) can include information whose confidentiality is protected by law or contract. Additionally, we maintain internal systems housing sensitive employee and confidential company data. As a result, our systems and IT work products are susceptible to systems or service failures resulting from technical complexity, failures of third-party service providers, natural disasters, power shortages, insider threats (including improper access to the Company’s, customers’ or third parties’ information or resources, employee error, or malfeasance), terrorist attacks, physical or electronic security breaches, cyber-attacks, computer viruses, or similar events or disruptions. Our systems and IT work product are the target of constantly evolving cyber-attack vectors, including malware, social engineering, denial-of-service attacks, malicious software programs, phishing, smishing, vishing, identity spoofing (including “deep fakes”), account takeovers, and other cyber-attacks fueled by emerging technologies, including cyber-attacks enhanced or facilitated by artificial intelligence. Additionally, future technological advances, including quantum computing, could potentially compromise the cryptographic foundations of our systems, posing additional risk to the security of those systems. We have observed an increase in the frequency and sophistication of the cyber and security threats these systems face, with attacks that are more advanced and persistent, targeting us because we hold classified, controlled unclassified, and other sensitive information. As a result, we and our vendors face a heightened risk of a security breach or disruption resulting from an attack by computer hackers, persons with access to systems inside our organization, foreign governments, and cyber terrorists. We also may from time to time modernize, upgrade, replace, or consolidate certain of our internal systems and related processes, and delays in implementing such changes or failures of such systems to operate as intended could disrupt our operations, require significant time, effort, and costs to implement changes or corrections, and adversely affect our business and results of operations.

Previous wording

We have put in place policies, controls, and technologies to help detect and protect against such attacks, but we cannot guarantee that future incidents will not occur. If an incident occurs, we may not be able to successfully mitigate the impact. We have been the target of these types of attacks in the past, and attempted attacks are likely to continue. Due to the ongoing geopolitical conflicts in Europe and the Middle East, and increased tensions in Asia, state-sponsored parties or their supporters may launch retaliatory cyber attacks, and may attempt to conduct other geopolitically motivated retaliatory actions. Those same parties may also attempt to fraudulently induce employees or authorized third parties, including contractors, to disclose sensitive information in order to gain access to our systems or data, or that of our customers, or service providers. If successful, these types of attacks on our network or other systems or service failures could have a material adverse effect on our business and results of operations, due to, among other things, the loss of customer or proprietary data, interruptions or delays in our customers' businesses, or damage to our reputation. In addition, the failure or disruption of our systems, communications, vendors, or utilities could cause us to interrupt or suspend our operations, which could have a material adverse effect on our business and results of operations. If our employees, contractors, suppliers or other authorized third parties do not adhere (whether inadvertently or intentionally) to appropriate information security protocols, our protocols are inadequate, or our or our customers' sensitive information is released and/or compromised, we may experience significant negative impacts to our reputation and expose us or our customers to liability. We are not immune from the possibility of a malicious insider compromising our information systems and infrastructure, including but not limited to insiders exfiltrating the personal data of employees and customers, stealing corporate trade secrets and key financial metrics, illegally diverting funds, or intentionally disclosing our secrets (e.g., application credentials) to others in order to bypass our security policies and control mechanisms. No series of measures can fully safeguard against every insider threat. Refer to “Item 1C. Cybersecurity” for additional information about our cybersecurity risk management program.

Current wording

We have put in place policies, controls, and technologies to help detect and protect against such attacks, but we cannot guarantee that future incidents will not occur. If an incident occurs, we may not be able to successfully mitigate the impact. We have been the target of these types of attacks in the past, and attempted attacks are likely to continue. Due to the ongoing geopolitical conflicts in Eastern Europe and the Middle East, and increased tensions in Asia, state-sponsored parties or their supporters may launch retaliatory cyber-attacks and may attempt to conduct other geopolitically motivated retaliatory actions. Those same parties may also attempt to fraudulently induce employees or authorized third parties, including contractors, to disclose sensitive information in order to gain access to our systems or data, or that of our customers, or service providers. If successful, these types of attacks on our network or other systems or service failures could have a material adverse effect on our business and results of operations, due to, among other things, the loss of customer or proprietary data, interruptions or delays in our customers' businesses, or damage to our reputation. In addition, the failure or disruption of our systems, communications, vendors, or utilities could cause us to interrupt or suspend our operations, which could have a material adverse effect on our business and results of operations. If our employees, contractors, suppliers or other authorized third parties do not adhere (whether inadvertently or intentionally) to appropriate information security protocols, our protocols are inadequate, or our or our customers' sensitive information is released and/or compromised, we may experience significant negative impacts to our reputation and expose us or our customers to liability. We are not immune from the possibility of a malicious insider compromising our information systems and infrastructure, including but not limited to insiders exfiltrating the personal data of employees and customers, stealing corporate trade secrets and key financial metrics, illegally diverting funds, or intentionally disclosing our secrets (e.g., application credentials) to others in order to bypass our security policies and control mechanisms. No series of measures can fully safeguard against every insider threat. Refer to “Item 1C. Cybersecurity” for additional information about our cybersecurity risk management program.

Previous wording

•be unable to successfully market services that are reliant on the creation and maintenance of secure information technology systems to U.S. government, international, and commercial customers;

Current wording

•be unable to successfully market services that are reliant on the creation and maintenance of secure information technology systems to U.S. government, foreign, and commercial customers;

Previous wording

•suffer claims by customers, employees, or impacted third parties for substantial damages, particularly as a result of any successful network or systems breach and exfiltration of customer and/or third-party information;

Current wording

•suffer claims by customers, employees, or impacted third parties for substantial damages, particularly as a result of any successful network or systems breach and exfiltration of customer and/or third-party information; or

Previous wording

In addition, we may have insufficient recourse against our vendors for costs, losses or claims we incur as a result of or reliance on their systems, services or other applications having significant defects, errors, or vulnerabilities, or which are successfully attacked by cyber and other security threats, resulting in our inability to meet our customers’ expectations. Further, in addition to any costs resulting from contract performance or required corrective action, these failures may result in increased costs or loss of revenue if they result in customers postponing subsequently scheduled work or canceling or failing to renew contracts.

Current wording

In addition, we may have insufficient recourse against our vendors or subcontractors for costs, losses or claims we incur as a result of or reliance on their systems, services or other applications having significant defects, errors, or vulnerabilities, or which are successfully attacked by cyber and other security threats, resulting in our inability to meet our customers’ expectations. Further, in addition to any costs resulting from contract performance or required corrective action, these failures may result in increased costs or loss of revenue if they result in customers postponing subsequently scheduled work or canceling or failing to renew contracts.

Previous wording

Any failure by us, our vendors or other business partners to comply with international, U.S. federal, state or local laws and regulations regarding data privacy, including the protection of personal or confidential information of our customers or employees which we may handle and process, or cybersecurity could result in significant monetary damages, regulatory enforcement actions, fines, penalties, private litigation or claims, and/or criminal prosecution in one or more jurisdictions, including as a result of the perception of our practices, products, and services in relation to violations of individual privacy, data protection rights, or cybersecurity requirements. We may also incur substantial expenses in implementing and maintaining compliance with such laws and regulations, or anticipated laws and regulations, including those that require certain types of data to be retained on servers within these jurisdictions. These laws and regulations, and anticipated laws and regulations, are increasing in complexity and number, change frequently, sometimes conflict or create different requirements across jurisdictions, and are subject to interpretation by different regulators and courts, creating the possibility of different compliance measures or enforcement risks across jurisdictions, which may cause additional expenses for compliance with such laws and regulations. Our failure to comply with applicable laws and regulations may result in privacy claims or enforcement actions against us, including liabilities, fines and damage to our reputation, any of which may have a material adverse effect on our results of operations.

Current wording

Any failure by us, our vendors or other business partners to comply with foreign, U.S. federal, state or local laws andregulations regarding data privacy, including the protection of personal or confidential information of our customers or employees which we may handle and process, or cybersecurity could result in significant monetary damages, regulatory enforcement actions, fines, penalties, private litigation or claims, and/or criminal prosecution in one or more jurisdictions, including as a result of the perception of our practices, products, and services in relation to violations of individual privacy, data protection rights, or cybersecurity requirements. We may also incur substantial expenses in implementing and maintaining compliance with such laws and regulations, or anticipated laws and regulations, including those that require certain types of data to be retained on servers within these jurisdictions or otherwise impose data sovereignty, localization, and cross-border transfer restrictions on how and where data is stored, processed, accessed, or transferred. These laws and regulations, and anticipated laws and regulations, are increasing in complexity and number, change frequently, sometimes conflict or create different requirements across jurisdictions, and are subject to interpretation by different regulators and courts, creating the possibility of different compliance measures or enforcement risks across jurisdictions, which may cause additional expenses for compliance with such laws and regulations. Our failure to comply with applicable laws and regulations may result in privacy claims or enforcement actions against us, including liabilities, fines and damage to our reputation, any of which may have a material adverse effect on our results of operations.

Previous wording

For example, the European Union’s General Data Protection Regulation (the “GDPR”), and the United Kingdom’s GDPR impose compliance obligations on companies that process personal data of people in the European Union and United Kingdom, respectively. In the U.S., numerous federal, state, and local data privacy laws and regulations govern the collection, use, and processing of personal information, provide rights to residents of those respective states, in some cases including personal information collected from residents in the context of recruitment and employment, as well as business-to-business arrangements. Compliance with these laws, or emerging international, U.S. federal, state or local privacy laws, requires investments into compliance programs, investments to deploy, operate and maintain technology that enables compliance, potential modifications to business processes, ongoing data protection activities and documentation requirements, and creates the potential for fines, individual claims and other liabilities for noncompliance as well as litigation risks, particularly in the event of a data breach, and could have a material adverse effect on our business, including how we use personal information or our results of operations. Certain international, U.S. federal, state laws and regulations also impose obligations to maintain and implement an information security program that includes administrative, technical, physical, or organizational safeguards, as well as obligations to give notice to affected individuals and to certain regulators in the event of a data breach. We may be required to spend significant resources to comply with these information security and data breach legal requirements. A significant data breach (including various forms of external attack, such as ransomware, as well as data incidents resulting from internal actions or omissions) could have negative consequences for our business and future prospects, including possible penalties, fines, damages, reduced customer demand, legal claims against and by customers, personnel, business partners or other persons claiming to be affected, harm to our systems and operations and harm to our reputation and brand.

Current wording

More than 20 U.S. states have enacted comprehensive privacy laws, and we are also subject to federal, state, local, and foreign privacy and data protection laws and regulations such as the European Union’s (“EU”) General Data Protection Regulation (the “GDPR”), and the United Kingdom’s GDPR, that impose compliance obligations on companies that process personal data. These data privacy laws and regulations govern the collection, use, and processing of personal information, provide rights to residents of those respective states, in some cases including personal information collected from residents in the context of recruitment and employment, as well as business-to-business arrangements. The number and fragmentation of these laws create a complex regulatory landscape. Compliance with these laws, or new and evolving foreign, U.S. federal, state or local privacy laws, requires investments into compliance programs, investments to deploy, operate and maintain technology that enables compliance, potential modifications to business processes, ongoing data protection activities and documentation requirements, and creates the potential for fines, individual claims and other liabilities for noncompliance as well as litigation risks, particularly in the event of a data breach, and could have a material adverse effect on our business, including how we use personal information or our results of operations. Certain foreign, U.S. federal, state laws and regulations also impose obligations to maintain and implement an information security program that includes administrative, technical, physical, or organizational safeguards, and in some cases may require cybersecurity audits, risk assessments, or compliance measures relating to automated decision-making technologies, as well as obligations to give notice to affected individuals and to certain regulators in the event of a data breach. We may be required to spend significant resources to comply with these information security and data breach legal requirements. A significant data breach (including various forms of external attack, such as ransomware, as well as data incidents resulting from internal actions or omissions) could have negative consequences for our business and future prospects, including possible penalties, fines, damages, reduced customer demand, legal claims against and by customers, personnel, business partners or other persons claiming to be affected, harm to our systems and operations and harm to our reputation and brand.

Previous wording

In addition, as a contractor supporting defense and national security customers, we are subject to certain additional regulatory compliance requirements relating to data privacy and cybersecurity. Under the DFARS and other federal regulations, our networks and IT systems are required to comply with the security and privacy controls in certain National Institute of Standards and Technology Special Publications (“NIST SP”). To the extent that we do not comply with the applicable security and control requirements, unauthorized access or disclosure of sensitive information could result in a contract termination, which could have a material adverse effect on our business and financial results and lead to reputational harm. We are also subject to the Department of Defense Cybersecurity Maturity Model Certification (“CMMC”), requirements, which will require all contractors to receive specific certifications relating to specified cybersecurity standards in order to be eligible for contract awards. In addition, CMMC certification requirements may be required in modifications to existing contracts. To the extent we are unable to achieve certification in advance of applicable contract awards that specify the requirement, we will be unable to bid on such contract awards or on follow-on awards for existing work with the Department of Defense, depending on the level of standard as required for each solicitation, or be ineligible to receive option awards under existing contracts that specify the certification requirement, which could adversely impact our revenue and profitability. In addition, our subcontractors, and in some cases our vendors, may also be required to adhere to the CMMC program requirements and potentially to achieve certification. Should our supply chain fail to meet compliance requirements or achieve certification, this may adversely affect our ability to receive award or execute on relevant government programs. In addition, any obligations that may be imposed on us under the CMMC may be different from or in addition to those otherwise required by applicable laws and regulations, which may cause additional expense for compliance.

Current wording

In addition, as a contractor supporting defense and national security customers, we are subject to certain additional regulatory compliance requirements relating to data privacy and cybersecurity. Under the DFARS and other federal regulations, our networks and IT systems are required to comply with the security and privacy controls in certain National Institute of Standards and Technology Special Publications (“NIST SP”). To the extent that we do not comply with the applicable security and control requirements, unauthorized access or disclosure of sensitive information could result in a contract termination, which could have a material adverse effect on our business and financial results and lead to reputational harm. We are also subject to the Department of War Cybersecurity Maturity Model Certification (“CMMC”), requirements, which are being phased into covered solicitations and contracts and require contractors to obtain specified certifications relating to cybersecurity standards in order to be eligible for certain contract awards and, in some cases, contract modifications or option exercises. Although we have obtained CMMC level 2 certification, maintaining that status and satisfying applicable ongoing compliance, assessment, affirmation, monitoring, remediation, and renewal requirements may require significant effort and expense. In addition, certain subcontractors and vendors may also be required to comply with CMMC requirements. If we, or members of our supply chain, fail to maintain required compliance or certification levels, we could be unable to bid on, receive, or continue performing certain contracts or contract options, which could adversely affect our revenue, profitability, and reputation. In addition, any obligations that may be imposed on us under the CMMC may be different from or in addition to those otherwise required by applicable laws and regulations, which may cause additional expense for compliance.

Previous wording

We develop and utilize artificial intelligence, which could expose us to risks including potential liability as well as regulatory, competition, reputational and other risks.

Current wording

We develop and use artificial intelligence, which could expose us to financial, regulatory, strategic, reputational, and other risks.

Previous wording

We utilize artificial intelligence, including generative artificial intelligence, machine learning, and similar tools and technologies that collect, aggregate, analyze, or generate data or other materials (collectively, “AI”) in connection with our business. The development, deployment and oversight of the use of AI by us, either directly, through our suppliers, or by engaging third-party AI developers, as well as the use of AI by competitors, is expected to require us to invest substantially in AI technology resources and related governance. There are significant risks involved in using AI and no assurance can be provided that our use of AI will enhance our products or services, produce the intended results, or keep pace with the use of AI by our competitors. For example, AI algorithms may produce incomplete, insufficient, biased or otherwise flawed results or rely upon biased or inaccurate data, and any of these deficiencies may not be easily detectable despite internal policies and diligence efforts in place to mitigate such deficiencies. The degraded or flawed performance could also result from adversarial attacks that include data poisoning, malware risks, and evasion techniques. If the AI that we use produces deficient, inaccurate, or controversial results, or if public opinion of AI is adversely affected due to actual or perceived risks regarding the usage of AI, we could incur operational inefficiencies, competitive harm, legal liability, brand or reputational harm, or other adverse impacts on our business and results of operations. Further, ownership and intellectual property rights of content generated by artificial intelligence is a developing area. This presents unique complexity and challenges that could affect our business and impact our delivery of AI-driven solutions. If we, or the third-party AI developers on which we rely, do not have sufficient rights to use the data or other material relied upon by such AI technologies, we also may incur liability through the alleged violation of applicable laws and regulations, third-party intellectual property, data privacy, or other rights, or contractual obligations. Although we conduct diligence on third-party AI developers, we will not be able to control the manner in which third-party AI technologies are developed or maintained.

Current wording

We use artificial intelligence, including agentic, physical, and adversarial artificial intelligence, and similar tools and technologies (collectively, “AI”) that collect, aggregate, manipulate, or generate data and systems in connection with our business. The development, deployment and oversight of the use of AI by us, either directly by our staff or indirectly through our suppliers or third-party AI developers, as well as the use of AI by competitors, requires us to invest substantially in AI technology resources and related governance. There is no guarantee that our use of AI will enhance our products or services, produce the intended results, or keep pace with the use of AI by our competitors. For example, AI algorithms may produce incomplete, insufficient, inaccurate, biased or otherwise flawed results or rely upon incomplete, insufficient, inaccurate, biased or otherwise flawed data, and any of these deficiencies may not be easily detectable despite the mitigations in place. Degraded or flawed performance could also result from adversarial attacks that include data poisoning, prompt injection, malware risks, and evasion techniques. If the AI that we use produces deficient, inaccurate, or controversial results, or if public opinion of AI is adversely affected due to actual or perceived risks regarding the usage of AI, we could incur operational inefficiencies, competitive harm, legal liability, brand or reputational harm, or other adverse impacts on our business. Further, ownership and intellectual property rights of content generated by or manipulated with AI is a developing area, presenting unique challenges that could affect our business interests and restrict our delivery of AI-driven solutions. If we, or the third-party AI developers on which we rely, do not have sufficient rights to use the data or other material relied upon by such AI technologies, we also may incur liability through the alleged violation of applicable laws and regulations, third-party intellectual property, data privacy, or other rights or contractual obligations. Although we conduct diligence on third-party AI developers, we will not be able to control the manner in which third-party AI technologies are developed or maintained. Our ability to develop, deploy, maintain, or scale AI technologies may also depend on our ability to obtain or access high-quality datasets, models, computing resources, and other AI system components from third parties on commercially reasonable terms, and any limitation, interruption, pricing change, licensing restriction, or other reduction in such access could impair our ability to deliver AI-enabled solutions competitively or at all. It is not possible to predict all the operational or technological risks that may arise relating to the use of AI, any of which may materially and adversely affect our business and results of operations.

Previous wording

Legal and regulatory frameworks related to the use of AI are evolving, including due to the perceived or actual risks of bias, lack of transparency, and information security. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, data privacy and security, consumer protection, competition, and equal opportunity laws, and may be subject to new laws and regulations or new interpretations of existing laws and regulations. AI is the subject of ongoing review by various U.S. and foreign governmental and regulatory agencies. For example, there have been significant changes in U.S. AI policy introduced by the new presidential administration, including the rescinding of the prior administration’s October 2023 executive order on Safe, Secure, and Trustworthy Artificial Intelligence. In addition, in March 2024, the EU enacted a new regulation applicable to certain AI technologies and the data used to train, test and deploy them. The enactment or expansion of laws and regulations related to the use of AI in our operations could result in increased compliance costs related to our use of AI, while the persistence of regulatory ambiguity results in uncertainty regarding potential compliance obligations and presents challenges to longer-term strategic decision-making. Additionally, we may not always be able to anticipate how courts and regulators will apply existing laws to AI, predict how new legal frameworks will develop to address AI, or otherwise respond to these frameworks as they are still rapidly evolving. We may also have to expend resources to adjust our offerings in certain jurisdictions if the legal frameworks on AI are not consistent across jurisdictions. Furthermore, it is not possible to predict all the operational or technological risks that may arise relating to the use of AI, any of which may materially and adversely affect our business and results of operations.

Current wording

Legal and regulatory frameworks related to the use of AI are evolving, including due to the perceived or actual risks of bias, lack of transparency, and information security. The technologies underlying AI and its uses are subject to a variety of laws and regulations, including intellectual property, data privacy and security, consumer protection, competition, and equal opportunity laws, and may be subject to new laws and regulations or new interpretations of existing laws and regulations. AI is the subject of ongoing review by various U.S. and foreign governmental and regulatory agencies. The U.S. policy environment for AI is rapidly changing through executive orders, other executive actions, agency guidance, procurement directives, and rulemaking, and these developments may impose new or different compliance obligations, alter enforcement priorities, and require us to modify our AI governance, development, deployment, and contracting practices. In addition, the EU AI Act, which applies to certain AI systems and general-purpose AI models and affects data and governance practices used to develop, test, deploy, and use them, is being implemented in phases. The enactment or expansion of laws and regulations related to the use of AI in our operations could result in increased compliance costs related to our use of AI, while the persistence of regulatory ambiguity results in uncertainty regarding potential compliance obligations and presents challenges to longer-term strategic decision-making. Additionally, we may not always be able to anticipate how courts and regulators will apply existing laws to AI how new legal frameworks will develop to address AI, or how we must respond to these frameworks, as they are rapidly evolving. We may also have to expend resources to adjust our offerings in certain jurisdictions if the legal frameworks are not consistent across jurisdictions.

Previous wording

Further, we face significant competition from other companies that are developing their own AI features and technologies. Other companies may develop AI features and technologies that are similar or superior to our technologies or are more cost-effective to develop and deploy. Additionally, while AI is currently the focus of significant investment and strategic prioritization, there is a risk that if the expected value of AI does not materialize at scale, or if high-profile AI failures emerge, customers may reassess their AI plans, which could lead to reduced funding and a reduction in certain of our AI initiatives. These factors could materially and adversely affect our business, financial condition and results of operations.

Current wording

Further, we face competition from other companies that are developing their own AI-enabled technologies, which may be superior to our technologies or more cost-effective to develop and deploy. In addition, as we develop and deploy AI-enabled solutions, our customers may not accept new pricing models designed to reflect the value, efficiency gains, or differentiated capabilities of those solutions, which could limit our ability to realize an adequate return on our AI investments. While AI is currently the focus of significant investment and strategic prioritization, there is a risk that if the expected value of AI does not materialize at scale, or if high-profile AI failures emerge, customers may reassess their AI plans, which could lead to reduced funding and a reduction in certain of our AI initiatives. These factors could materially and adversely affect our business, financial condition and results of operations.

Previous wording

Our business depends in large part upon our ability to attract and retain sufficient numbers of highly qualified individuals who may have advanced degrees and/or appropriate security clearances. We compete for such qualified personnel with other U.S. government contractors, the U.S. government, and private industry, and such competition is intense. Personnel with the requisite skills, qualifications, or security clearance may be in short supply or generally unavailable. The government and industry have recognized that the current process for obtaining security clearances is time-consuming, sometimes taking years to complete, and can present a risk to customer mission. See “—We may fail to obtain and maintain necessary security clearances which may adversely affect our ability to perform on certain contracts.”

Current wording

Our business depends in large part upon our ability to attract and retain sufficient numbers of highly qualified individuals who may have advanced degrees and/or appropriate security clearances. We compete for such qualified personnel with other U.S. government contractors, the U.S. government, and private industry, and such competition is intense. Personnel with the requisite skills, qualifications, or security clearance may be in short supply or generally unavailable. The government and industry have recognized that the current process for obtaining security clearances is time-consuming, sometimes taking years to complete, and can present a risk to customer mission. See “—We may fail to obtain and maintain necessary security clearances which may adversely affect our ability to perform on certain contracts.” In addition, as technologies and customer demands evolve rapidly, including in AI and other advanced technologies, we may need to make significant investments to train and re-skill our workforce, and we may not be successful in doing so quickly enough or at all.

Previous wording

Our ability to attract and retain skilled and qualified employees may also be impacted by our engagements in, or perceived connections to, politically or socially sensitive activities. In addition, our ability to recruit, hire, and internally deploy former employees of the U.S. government is subject to complex laws and regulations, which may serve as an impediment to our ability to attract such former employees, and failure to comply with these laws and regulations may expose us and our employees to civil or criminal penalties. Additionally, our ability to attract, hire, and retain skilled and qualified employees may be impacted by pandemics, epidemics or similar disease outbreaks.

Current wording

Our ability to recruit, hire, and internally deploy former employees of the U.S. government is subject to complex laws and regulations, which may serve as an impediment to our ability to attract such former employees, and failure to comply with these laws and regulations may expose us and our employees to civil or criminal penalties. Additionally, our ability to attract, hire, and retain skilled and qualified employees may be impacted by our engagements in, or perceived connections to, politically or socially sensitive activities, adverse labor and economic market conditions, as well as pandemics, epidemics or similar disease outbreaks.

Previous wording

Adverse labor and economic market conditions and intense competition for skilled personnel may inhibit our ability to recruit new employees, including any necessary actions in response to any pandemics, epidemics or similar disease outbreaks. If we are unable to recruit and retain a sufficient number of qualified employees, or cannot obtain their appropriate security clearances ina timely manner, or fail to deploy such employees, our ability to maintain and grow our business and to effectively serve our customers could be limited and our future revenue and results of operations could be materially and adversely affected. Furthermore, to the extent that we are unable to make necessary permanent hires to appropriately serve our customers, we could be required to engage larger numbers of contracted personnel, which could reduce our profit margins.

Current wording

If we are unable to recruit and retain a sufficient number of qualified employees, or cannot obtain their appropriate security clearances in a timely manner, or fail to deploy such employees, our ability to maintain and grow our business and to effectively serve our customers could be limited and our future revenue and results of operations could be materially and adversely affected. Furthermore, to the extent that we are unable to make necessary permanent hires to appropriately serve our customers, we could be required to engage larger numbers of contracted personnel, which could reduce our profit margins.

Previous wording

Many U.S. government programs require contractor employees and facilities to have security clearances. Security clearances are issued at the discretion of the U.S. government and there can be no assurance that we will be able to obtain or maintain the security clearances necessary to perform our contracts. Depending on the level of required clearance, security clearances can be difficult and time-consuming to obtain. In the current environment we are seeing delays by the U.S. government in the processing of security clearances and there have been recent examples of large numbers of security clearances being revoked by executive orders by the new presidential administration. If we or our employees are unable to obtain or retain necessary security clearances in a timely manner, or a significant number of our employees lose security clearances, we may not be able to win new business, and our existing customers could terminate their contracts with us or decide not to renew them. To the extent we are not able to obtain and maintain facility security clearances or engage employees with the required security clearances for a particular contract, we may not be able to bid on or win new contracts, effectively rebid on expiring contracts, or retain existing contracts, which may adversely affect our operating results and inhibit the execution of our growth strategy.

Current wording

Many U.S. government programs require contractor employees and facilities to have security clearances. Security clearances are issued at the discretion of the U.S. government and there can be no assurance that we will be able to obtain or maintain the security clearances necessary to perform our contracts. Depending on the level of required clearance, security clearances can be difficult and time-consuming to obtain. In the current environment we are seeing delays by the U.S. government in the processing of security clearances and there have been recent examples of large numbers of security clearances being revoked by executive orders. If we or our employees are unable to obtain or retain necessary security clearances in a timely manner, or a significant number of our employees lose security clearances, we may not be able to win new business, and our existing customers could terminate their contracts with us or decide not to renew them. To the extent we are not able to obtain and maintain facility security clearances or engage employees with the required security clearances for a particular contract, we may not be able to bid on or win new contracts, effectively rebid on expiring contracts, or retain existing contracts, which may adversely affect our operating results and inhibit the execution of our growth strategy.