Redwire Corp

Evaluation of Disclosure Controls and Procedures

Our management, with the participation of our principal executive officer and principal financial officer, has evaluated the effectiveness of our disclosure controls and procedures, which are designed to ensure that the information required to be disclosed in reports that we file or submit under the Securities Exchange Act of 1934, as amended, is recorded, processed, summarized and reported within the time periods specified in the SEC's rules and forms, including ensuring that such information is accumulated and communicated to management (including the principal executive officer and principal financial officer) as appropriate to allow timely decisions regarding required disclosure. Based on such evaluation, our principal executive officer and our principal financial officer have concluded that such disclosure controls and procedures were not effective as of December 31, 2024 due to the material weaknesses in internal control over financial reporting described below.

Management’s Report on Internal Control Over Financial Reporting

Our management is responsible for establishing and maintaining adequate internal control over financial reporting (as defined in Rule 13a-15(f) and 15d-15(f) under the Exchange Act). Internal control over financial reporting is a process designed to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external reporting purposes in accordance with accounting principles generally accepted in the U.S. Because of its inherent limitations, internal control over financial reporting may not prevent or detect misstatements.

Our management, with the participation of our principal executive officer and principal financial officer, conducted an assessment of the effectiveness of our internal control over financial reporting as of December 31, 2024. This assessment was based on the criteria set forth by the Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”). Based on this assessment, management concluded that our internal control over financial reporting was not effective as of December 31, 2024 because of the material weaknesses described below.

In accordance with Section 103 of the Jumpstart Our Business Startups (“JOBS”) Act, the Company is not required to comply with the requirement to provide an auditor’s report on Internal Controls over Financial Reporting under Section 404(b) of the Sarbanes-Oxley Act for as long as it qualifies as an emerging growth company.

Material Weaknesses in Internal Control over Financial Reporting

A material weakness is a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim consolidated financial statements will not be prevented or detected on a timely basis.

In connection with the Company’s evaluation of internal control over financial reporting, the following material weaknesses have been identified:

•We have not consistently established appropriate authorities and responsibilities in pursuit of financial reporting objectives, as demonstrated by, among other things, insufficient segregation of duties in our finance and accounting functions.

•We did not design and maintain formal accounting policies, procedures and controls to achieve complete, accurate and timely financial accounting, reporting and disclosures, including controls over the preparation and review of business performance reviews, account reconciliations, journal entries and contract estimates used in determining the recognition of revenue.

These material weaknesses could result in misstatements of substantially all accounts and disclosures that could result in a material misstatement to the annual or interim consolidated financial statements that would not be prevented or detected.

In addition, we did not design and maintain effective information technology (“IT”) general controls for information systems that are relevant to the preparation of the consolidated financial statements. Specifically, we did not design and maintain:

•program change management controls to ensure that information technology program and data changes affecting financial IT applications and underlying accounting records are identified, tested, authorized, and implemented appropriately;

•user access controls to ensure appropriate segregation of duties and that adequately restrict user and privileged access to financial applications, programs, and data to appropriate Company personnel;

•computer operations controls to ensure that critical batch jobs are monitored and data backups are authorized and monitored; and

•testing and approval controls for program development to ensure that new software development is aligned with business and IT requirements.

The IT deficiencies, when aggregated, could impact maintaining effective segregation of duties, as well as the effectiveness of IT-dependent controls (such as automated controls that address the risk of material misstatement of one or more assertions, along with the IT controls and underlying data that support the effectiveness of system-generated data and reports) that could result in misstatements potentially impacting all financial statement accounts and disclosures that would not be prevented or detected.

The material weaknesses above did not result in a material misstatement to the consolidated financial statements presented in this Annual Report on Form 10-K, nor in any restatements of consolidated financial statements previously reported by us.

Remediation Plans

We are in the process of implementing measures designed to improve our internal control over financial reporting and remediate the deficiencies that led to the material weaknesses, including training, designing and implementing new control activities, and enhancing existing control activities.

•We engaged a third-party global consulting firm to accelerate the design of new controls or enhance existing controls to ensure timely and accurate financial reporting across our operations in both the U.S. and Europe.

•We will continue to conduct training and document our processes and procedures, including accounting policies, and implement a comprehensive financial closing process checklist with additional layers of reviews. We are also in the process of standardizing controls, processes and policies across the Company to ensure consistent application including controls over the preparation and review of business performance reviews, account reconciliations, journal entries and contract estimates used in determining the recognition of revenue.

•We are in the process of performing an assessment of all IT systems that provide data for financial reporting purposes and consolidating systems where appropriate, including, but not limited to, implementing one enterprise resource planning (“ERP”) system for our U.S. operations and one ERP system for our Europe operations. As part of this assessment, we will be designing, implementing and documenting IT general controls.

We are working to remediate the material weaknesses as efficiently and effectively as possible and expect full remediation for our U.S. operations will likely be complete by December 31, 2025 and full remediation for our Europe operations will likelygo beyond December 31, 2025. At this time, we cannot provide an estimate of costs expected to be incurred in connection with implementing this remediation plan; however, these remediation measures will be time consuming, will result in the Company incurring additional costs, and will place additional demands on our financial and operational resources.

If we are unable to successfully remediate existing or any future material weaknesses in our internal control over financial reporting, the accuracy and timing of our financial reporting may be adversely affected, investors may lose confidence in our financial reporting, and/or we could become subject to litigation or investigations by the New York Stock Exchange (“NYSE”), the SEC or other regulatory authorities.

Changes in Internal Control over Financial Reporting

There have been no changes in internal control over financial reporting during the three months ended December 31, 2024 that have materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.