GENERAL ELECTRIC CO

CYBERSECURITY. The description in this section reflects GE Aerospace’s approach as of December 31, 2024, following the spin-off of GE Vernova in April 2024.

CYBERSECURITY RISK MANAGEMENT AND STRATEGY. GE Aerospace has developed and implemented a cybersecurity framework intended to assess, identify and manage risks from threats to the security of our information, systems, products and network using a risk-based approach. The framework is informed in part by the National Institute of Standards and Technology (NIST) Cybersecurity Framework and International Organization for Standardization 27001 (ISO 27001) Framework, although this does not imply that we meet all technical standards, specifications or requirements under the NIST or ISO 27001. We are also guided by applicable cybersecurity rules, regulations and contractual commitments related to our role as a defense contractor, such as auditing by the Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center (DIBCAC), the UK Ministry of Defense, and Certified Third Party Assessor Organizations (C3PAO).

Our key cybersecurity processes include the following:

•Risk-based controls for information systems and information on GE Aerospace’s networks: We seek to maintain an information technology infrastructure that implements physical, administrative and technical controls that are calibrated based on risk and designed to protect the confidentiality, integrity and availability of our information systems and information stored on GE Aerospace’s networks, including customer information, personal information, intellectual property and proprietary information.

•Cybersecurity incident response plan and testing: We have a cybersecurity incident response plan and dedicated teams to respond to cybersecurity incidents. When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate. GE Aerospace’s cybersecurity teams assist in responding to incidents depending on severity levels and seek to improve our cybersecurity incident management plan through periodic tabletops or simulations.

•Training: We provide security awareness training to help our employees understand their information protection and cybersecurity responsibilities. We also provide additional role-based training to some employees based on customer requirements, regulatory obligations and industry risks.

•Supplier risk assessments: We have implemented athird-party risk management process that includes expectations regarding information and cybersecurity. That process, among other things, provides for GE Aerospace to perform cybersecurity assessments on certain suppliers based on an assessment of their risk profile and a related rating process. GE Aerospace also seeks contractual commitments from key suppliers to appropriately secure and maintain their information technology systems and protect any GE Aerospace information and network access that is provided to them.

•Third-party assessments of GE Aerospace: We have third-party cybersecurity companies engaged to periodically assess GE Aerospace’s cybersecurity posture, to assist in identifying and remediating risks from cybersecurity threats.

We also consider cybersecurity, along with other top risks for GE Aerospace, within ourenterprise risk management framework. The enterprise risk management framework includes internal reporting at the business and enterprise levels, with consideration of key risk indicators, trends and countermeasures for cybersecurity and other types of significant risks. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, cash flow or financial condition. We face certain ongoing risks from cybersecurity threats—including heightened threats in connection with the separation of GE HealthCare and GE Vernova—that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, financial condition or cash flows. Refer to the Risk Factors section (Cybersecurity - Increased cybersecurity requirements, vulnerabilities, threats and more sophisticated and targeted computer crime, as well as cybersecurity failures, pose risk to our systems, networks, products, solutions, services and data.) for additional information about these risks.

CYBERSECURITY GOVERNANCE. The Audit Committee of the GE Aerospace Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee reports back to the full Board about this and other areas within its responsibility. As part of its oversight role, the Audit Committee receives reporting about GE Aerospace’s practices, programs, notable threats or incidents and other developments related to cybersecurity throughout the year, including through periodic updates from GE Aerospace’s Chief Information Officer (CIO) and Chief Information Security Officer (CISO) on cyber threats and our cybersecurity risk management strategy. The Audit Committee also receives information about cybersecurity risks as part of GE Aerospace’s enterprise risk management framework and reporting.

GE Aerospace’s management team is ultimately responsible for assessing and managing risks from cybersecurity threats, and in this regard, the CIO and CISO lead the Company’s overall cybersecurity function and cybersecurity leadership team. The CIO has over 25 years of experience in the information technology (IT) field and leads the IT strategy and services supporting the Company’s global operation. The CISO has over 25 years of experience focused on global information assurance and cyber security programs. The cybersecurity leadership team meets with senior management to review and discuss GE Aerospace’s cybersecurity program, including emerging cyber risks, threats and industry trends. The cybersecurity leadership team also assists management in supervising efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including by collaborating with internal security personnel and business stakeholders, and incorporating threat intelligence and other information obtained from governmental, public or private sources to inform our cybersecurity technologies and processes.

2024 FORM 10-K 25