Huntington Ingalls Industries, Inc. · NYSE:HII
Huntington Ingalls Industries — External Supplier Webinar: Sensitive Information, Cybersecurity and Data Protection (November 2025)
29 slides from Huntington Ingalls Industries's conference presentation, Nov 19, 2025
Slide 1: External Supplier Webinar: Sensitive Information, Cybersecurity and Data Protection
External Supplier Webinar: Sensitive Information, Cybersecurity and Data Protection Newport News Shipbuilding A Division of HII Eva Latimer, Allyson Ladner, and Greg Bandish Nov. 18th and Nov. 19th, 2025
Slide 2: Housekeeping
Housekeeping We have all attendees joined on mute. As we go through the presentation, please submit questions via the chat box to the panelists and we will address them during pauses throughout the webinar. Thank you for attending!
Slide 3: Presentation Speakers
Presentation Speakers Eva Latimer Allyson Ladner Greg Bandish Manager, Regulatory Compliance Cybersecurity Supply Chain Risk CMMC Program Manager Newport News Shipbuilding HII Oxford Global Resources
Slide 4: Agenda Topics
1. Supplier Support & Resources Agenda Topics 2. Cybersecurity & BitSight 3. Federal Contract Information (FCI) 4. Controlled Unclassified Information (CUI) 5. CMMC Model 2.0 Requirements 6. Naval Nuclear Propulsion Information (NNPI) 4
Slide 5: Supplier Support & Resources
Supplier Support & Resources HII.com/Cyber 5
Slide 6: BitSight
BitSight NNS uses a third-party service that helps HII assess and monitor the “external facing” cybersecurity posture of our Suppliers. Supply Chain Continuous Compliance Risk Competitive Management Monitoring and Reporting Mitigation Advantage • Identification of • As opposed to • Ensures • Identif
Slide 7: BitSight and Supplier Actions Working Together on Cybersecurity Posture
BitSight and Supplier Actions Working Together on Cybersecurity Posture • Access to Suppliers no cost • Supplier can be notified of vulnerabilities to take action to remediate • HII Cybersecurity monitors critically identified vulnerabilities by Supplier • Un-remediated critical vulnerabilities may
Slide 8: Protecting Sensitive Information
Protecting Sensitive Information It is everyone’s responsibility to protect sensitive information. Three common forms of information distributed or received by NNS are: • Federal Contract Information (FCI) • Controlled Unclassified Information (CUI) • Unclassified Naval Nuclear Propulsion Informatio
Slide 9: FCI and CUI
FCI and CUI FCI CUI Information not intended for public Information the Government FCI and CUI are information that release that is provided by or creates or possesses, or that is ‘not intended for public generated for the Government an entity creates or possesses release.’ However, CUI requires und
Slide 10: Sensitive Information Requirements Matrix for Electronic Transmissions
Sensitive Information Requirements Matrix for Electronic Transmissions The below matrix outlines requirements for sensitive information received by Suppliers from NNS. There are physical protection requirements to receive sensitive information in hard copy format. Category or Document Marking Exampl
Slide 11: Transmission of FCI and CUI - Hardcopy
Transmission of FCI and CUI - Hardcopy Manages cybersecurity risk of our supply chain based on a three-pronged approach: The hardcopy transmission methods are the same for FCI and CUI. May be sent to stand-alone fax machines • Faxed within the US and its territories provided there is an authorized p
Slide 12: Transmission of FCI and CUI - Electronic
Transmission of FCI and CUI - Electronic The electronic transmission methods are the same for FCI and CUI. • Exostar Forum Pass/Information Manager available until 12/31/25 • Virtru application – Coming soon • Email Encryption employing FIPS 140-2/140-3 encryption solution • Physically mailed to the
Slide 13: FCI and CUI Controls
FCI and CUI Controls When In Disposal and Storage Use Destruction Concepts outlined below may not be all inclusive, depending on sensitivity nature of material. ➢ Control information posted or ➢ Physical protection controls ➢ Unless NNS authorizes retention by processed on publicly accessible the Su
Slide 14: Supplier-Originated CUI Documents
Supplier-Originated CUI Documents Supplier-originated documents that reproduce, expand upon, or modify information drawn from documents that now contain CUI must have the appropriate marking.
Slide 15: What is CMMC?
What is CMMC? Verifying that Level Information Type Method companies are Core of CMMC L2: FCI: Information that is not intended for public release and is actually DFARS 252.204-7012, NIST SP 800-171 & Level 1 provided by or generated for the government under a contract to develop or deliver a produc
Slide 16: CMMC Levels
CMMC Levels Tiered Model: Security requirements scale with sensitivity of data Assessments: Verifies compliance through independent review Contracts: Certification required to win and hold work 16
Slide 17: CMMC Phased Rollout
CMMC Phased Rollout Start Date: Phase 1 – Initial Implementation November 10, - Began 10 Nov 25 Phase 2 2025 - Where applicable, Phase 3 solicitations will require - Begins 10 Nov 26 Four-Phases: Level 1 or Level 2 Self- Assessment - Where applicable, solicitations will require - Begins 10 Nov 27 Ph
Slide 18: CMMC Asset Categories
CMMC Asset Categories Contractor Risk Managed Assets CUI Assets: Systems, devices, or tools (CRMAs): Company-owned systems that process, store, or transmit CUI. Security Protection Assets (SPAs): that don’t touch CUI directly but still Think of them as the places where Systems or tools that protect
Slide 19: eProcurement Tools
eProcurement Tools • NNS has two eProcurement tools for NNS and Suppliers to communicate. • Exostar Forum Pass / Information Manager active until 12/31/25. • Does not impact Exostar Supply Chain Platform (SCP) • Virtru – Coming Soon --- Allows sending of secure files to suppliers. Security features
Slide 20: Pre-submittal Requirements for DLA Joint Certification Program (JCP)
Pre-submittal Requirements for Defense Logistics Agency (DLA) Joint Certification Program (JCP) Complete NIST SP 800- Active Current 171 Commercial System for assessment Complete DD and Award and load Form 2345 Government Management scores into (JCP Entity (CAGE) (SAM) Supplier application) Code reg
Slide 21: U-NNPI
U-NNPI CUI U-NNPI 48 CFR 52.204-21 FCI 32 CFR Part 2002 Unclassified information concerning the design, arrangement, development, manufacture, testing, operation, administration, training, maintenance, and What is OPNAV repair of the propulsion plants of naval N9210.3? nuclear-powered ships and prot
Slide 22: OPNAVINST N9210.3
OPNAVINST N9210.3 • Guidance document for NNPI protections • Applicable to all equipment, components, systems, documents, drawings, information technology (IT) media, audiovisual media, and any other media or items containing classified or unclassified NNPI • Contains definitions, marking requiremen
Slide 23: Sensitive Information Requirements Matrix for Electronic Transmissions
Sensitive Information Requirements Matrix for Electronic Transmissions The below matrix outlines requirements for sensitive information received by Suppliers from NNS. There are requirements to receive U-NNPI in hard copy format, as outlined below. 23
Slide 24: Hardcopy Transmission of NNPI
Hardcopy Transmission of NNPI • Faxed to a stand-alone fax machine • Faxed within the US and its territories provided there is an authorized person waiting to receive the document and properly control it; AND • Provided the receiving device is not connected to a computer) • NNPI may not be faxed out
Slide 25: U-NNPI Authorized Computers and Electronic Transmission
U-NNPI Authorized Computers and Electronic Transmission • U-NNPI may not be processed or stored on a Supplier-owned computer system or portable electronic device unless authorized by NAVSEA 08 Cybersecurity. U-NNPI may only be transmitted via the Internet to NAVSEA- approved computer systems. • S/MI
Slide 26: U-NNPI Controls
U-NNPI Controls When In Disposal and Storage Use Destruction “Authorized individuals” are U.S. citizens or U.S. nationals with a Need to Know (NTK). Resident aliens (“green card” holders) are prohibited. NAVSEA 08 Security must be notified before granting access to Dual Citizens with NTK. ➢ Material
Slide 27: Supplier-Originated U-NNPI Documents
Supplier-Originated U-NNPI Documents • Supplier-originated documents that reproduce, expand upon, or modify information drawn from U-NNPI documents must have the NOFORN marking at the top and bottom of every page. • The following warning statement must appear on a cover sheet or displayed on the fir
Slide 28: U-NNPI Disclosure Policy for NNS Suppliers
U-NNPI Disclosure Policy for NNS Suppliers • Supplier shall report to their NNS Buyer any attempts by unauthorized persons to elicit U-NNPI and any known or suspected compromises of U-NNPI • Includes intentional or unintentional public release via such methods as: • Known or suspected compromise of
Slide 29: Thank you for attending today's webinar
Questions - Add any questions to the Chatbox. Thank you for attending today’s webinar. Stay tuned --- A PDF copy of the webinar will be posted to the NNS Supplier website.