Quality and Safety

Quality and Safety

Quality is an integral part of Mercury’s business principles. While quality is first and foremost about best-in-class products, it is also about delivering on our Mercury Assured Promise of earnestly combining our unique Culture, Values and Vision to turn ideas into results for our customers, delivering trusted and secure solutions at the speed of innovation. In addition, Mercury knows that our people are our most valuable asset and is committed to providing a safe and healthy workplace for all of our team members, contractors, visitors and the public. 

CLICK TO JUMP DOWN TO CONTENT
Our Quality Policy
Safety
Cyber and Industrial Security

Our Quality Policy

We deliver what we promise, when we promise it, and what we deliver meets customer expectations.

How do we accomplish this? 

  • By engaging our external customers and listening to what they tell us
  • By establishing and meeting Quality objectives for products and processes that are based on customers' expectations
  • By providing hardware, software and service solutions that function as described and are delivered on time
  • By monitoring and measuring the results vs. objectives and taking action when they are not met
  • By continuously improving the effectiveness of our Quality System
     

Mercury Systems locations registered to the following Quality Management Systems Standards

Additional Certifications

IPC Validation Services RECOGNIZED logo

Mercury IPC Membership Certificate

Safety 

We are committed to providing a safe and healthy work environment that protects our people, customers, vendors and the public from injury. Team members at every level are responsible and accountable for our safe operations and safety program. Complete and active participation by everyone, every day, in every job is necessary to ensure our safety. 

We have adopted internal health and safety policies. It’s the responsibility of management to adhere to these standards in the design and implementation of our policies, procedures, work instructions and daily practices. It is the responsibility of every team member to protect his or her own health and safety by working in compliance with the law and by following company policy. 

Many national and local laws protect employees from unsafe working conditions. These laws differ among different jurisdictions and subject matter. We expect our team members and vendors to respect and comply with these legal protections. 

Our OSHA injury rate data for our sites in the U.S. is reported below for the three most recent calendar years. 

calendar year # of recordable cases # of employee labor hours worked OSHA recordable incident rate incidents with lost days/ restricted days/ transferred dart rate
2023 7 4,051,487 0.34 1 0.04
2022 6 3,670,370 0.32 0 0.00
2021 6 3,520,364 0.34 1 0.05

 

Additionally, there have been zero fatalities at our sites in calendar years 2021, 2022, and 2023.

Cyber and Industrial Security 

In the past decade, our robust investment in research and development has led to the generation of a substantial amount of intellectual property. As we continue to innovate, acquire new companies and develop new capabilities, we expect to continue to benefit from an increase in outsourced subsystem development work by our prime defense contractor customers and U.S. government customers. At the same time, intelligence collection and information theft by malicious adversaries globally is emerging as a fast-growing common threat.

Our visibility and security risk profile may increase with our growth in the aerospace and defense (A&D) sector, and as our customers continue to entrust us with more of their data. That growing presence reinforces the importance of our commitment to ensuring the highest standard of security practices. Specifically, with our increased prominence, nation-state adversaries have taken note of our role in the defense supply chain. As the defense primes strengthen their security posture, the next tier of the defense supply chain has been identified as a potential weaker link that nation-states look to compromise. Further, as we have observed on numerous occasions with other companies, successful security attacks can have severe negative impacts on a business’ reputation with key stakeholders, including customers and investors.

Mercury's executive leadership team has tasked our Information Technology, Cybersecurity and Security teams with the responsibility for developing, maintaining and communicating a comprehensive security portfolio to:

  •  protect the confidentiality, integrity, availability, authenticity, control and utility of our information resources;
  • ensure compliance with applicable statutory, regulatoryand contractual compliance obligations, such as the Securities and Exchange Commission's Sarbanes-Oxley Act and the Department of Defense's Cybersecurity Maturity Model Certification (CMCC);
  • deploy adequate safeguards to better protect our resources, data and systems; and,
  • focus on implementing processes that reliably safeguard information and property, continuously identify malicious activity and regularly educate our workforce.

With the global cyber landscape continually changing, and new threats appearing daily, a dedicated team and scalable architecture with layers of defenses is critical to defending valuable data entrusted to us. We are also aware that we have a downstream responsibility to help suppliers secure their systems and processes, as demonstrated in our efforts to evaluate and assist the next tier of our supply chain. We have engaged a third party to assess our suppliers' readiness to meet our obligations and requirements and to help those suppliers in their readiness. Our mission is for Mercury and our suppliers to successfully obtain CMCC certification.

We have also invested and paid particular attention to developing processes to mitigate risks of acquiring and integrating new companies along with their employees and systems into our systems and protocols. We remain committed to continue modeling based on industry best practices.

We have insurance policies that cover us in the event of certain types of information security breaches.

Our diligent work on our security has been consistently recognized through audits and awards:

  • Cybersecurity Audit. After a comprehensive third-party audit, Mercury received a letter of assurance confirming it has satisfactory controls in place for cybersecurity requirements of the Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 and the National Institute of Standards and Technology Special Publication (NIST SP) 800-171. The five-week assessment established that Mercury implemented satisfactory controls and is compliant with all 110 controls. Additionally, Mercury has earned a NIST SP 800-171 High Assessment from the Defense Industrial Base Cyber Security Assessment Center (DIBCAC). Ensuring these regulations flow through the entire supply chain is critical to the success of the DFARS/NIST cybersecurity initiative. Mercury has received objective verification of having a “complete” cybersecurity controls program in place, demonstrating its commitment to helping its customers meet their trusted supply chain requirements.
  • Industrial Security Awards. We have deployed and have been relying upon a best-in-class industrial security program as evidenced by superior ratings from the U.S. Defense Counterintelligence and Security Agency (DCSA). DCSA has recognized six of Mercury’s facilities with the James S. Cogswell Outstanding Industrial Security Achievement Award over the last several years. The Cogswell Award is the most prestigious honor that the DCSA can bestow to a U.S.-cleared company. Less than 1% of the 13,000+ cleared contractor facilities in the National Industrial Security Program receive this award annually. The Cogswell Award is based on many factors, including dedication to education and training programs, management support, security staff experience, and most importantly, the employees of a company. This award is a testament to our corporate commitment and the best practices of all Mercury team members for their unwavering support of our nation’s security. Mercury’s facilities in Andover, Massachusetts; Cypress, California; West Caldwell, New Jersey; Hudson, New Hampshire; West Lafayette, Indiana; and Phoenix, Arizona, have all received Cogswell awards. 

Acquisitions and Growth

We are continuously searching for ways to improve the security posture of the Mercury network, especially given our strategic growth objectives, which include a continued pace of acquiring companies and capabilities. As a result, we remain focused on mitigating risks associated with the acquisition of new companies and employees.

We perform a full security assessment of the acquired company prior to connecting it to our network. The acquired company will be integrated with standard Mercury network hardware, end-user devices, business applications and engineering tools. Our One Mercury approach ensures that we are not jeopardizing our security posture for the sake of business growth.

Insiders represent a challenging threat to defend. We are continually evaluating new technologies to help detect abnormal behavior of those who access our network. We leverage third-party resources so that between Mercury IT personnel and third parties we monitor our network 24/7.

Downstream Responsibility

We continue to look at the next tier of the supply chain, evaluate their maturity and help those suppliers take affordable steps to make them more secure.

DCSA has recognized cybersecurity as the base of defense base security. Signs point toward defense suppliers being rated, similar to a credit rating, on their ability to protect customer assets and deliver products uncompromised under a Cybersecurity Maturity Model Certification framework.

Training

We regularly train our employees about industrial and cybersecurity matters, with enhanced training for employees in special positions. We leverage the latest threat intelligence and vendor content to ensure our user training and anti-phishing campaigns represent the current threats our employees are likely to encounter. We routinely test our workforce through simulated phishing campaigns, including corrective action instructions for employees who click on links in the simulated attacks.   

Contact us to discover what's possible at the edge

Contact Mercury