3 unchanged sentences
Amgen has a multi-layered and iterative approach towards assessing, identifying, managing and mitigating risks from cybersecurity threats.
−Removed: The Company’s Digital, Technology & Innovation (DTI) function is designed to support our productivity, innovation and outreach globally through the quality delivery of information systems, solutions and services for our business and operations.
−Removed: The DTI function has a Cybersecurity & Digital Trust (CDT) team that assesses and reduces cybersecurity exposure, including by providing employees with training and resources to identify potential cybersecurity threats and implementing information technology security practices.
+Added: The Amgen Technology & Medical Organizations (ATMOS) function is designed to support our productivity, innovation and outreach globally through the quality delivery of information systems, solutions and services for our business and operations.
+Added: The ATMOS function has a Cybersecurity & Digital Trust (CDT) team that assesses and reduces cybersecurity exposure, including by providing employees with training and resources to identify potential cybersecurity threats and implementing information technology security practices.
The CDT team also monitors for cybersecurity threat activity and seeks to mitigate the impact from cybersecurity incidents by deploying information security engineers, system architects, analysts and cybersecurity specialists to provide monitoring, reporting and management of cybersecurity incidents.
−Removed: To evaluate the progress of its activities, our DTI function uses various industry and regulatory frameworks as guides to assess the state of the Company’s cybersecurity program maturity and controls, including our organizational, people, physical and technological controls.
−Removed: The CDT team also conducts reviews and evaluations of our cybersecurity resilience program with Amgen’s Cybersecurity & Digital Trust Governance Council (which includes leaders from information security, compliance, regulatory affairs, manufacturing, audit, law and business development functions).
+Added: To evaluate the progress of its activities, our ATMOS function uses various industry and regulatory frameworks as guides to assess the state of the Company’s cybersecurity program maturity and controls, including our organizational, people, physical and technological controls.
+Added: The CDT team also conducts reviews and evaluations of our cybersecurity resilience program with Amgen’s Cybersecurity & Digital Trust Governance Council (which includes leaders from CDT, Worldwide Compliance and Business Ethics, Regulatory Affairs, Operations, R&D, Global Commercial Operations, Corporate Audit, Law and Business Development functions).
Our cybersecurity risk management program is considered by and integrated into our Company-wide Enterprise Risk Management program and shares common methodologies, reporting channels and governance processes that apply across the Enterprise Risk Management program to that of other enterprise level risks (such as product development, safety and surveillance, financial and intellectual property risks).
Regular evaluations are conducted of the greatest risks to our business and their underlying risk drivers as well as the associated mitigation activities, maturity and controls.
−Removed: This program is overseen by our Executive Vice President and Chief Financial Officer and guided by the Enterprise Risk Council, a cross-functional group of the Company’s business leaders representing key business functions that is chaired by our Chief Audit Executive.
+Added: This program is overseen by our Executive Vice President and Chief Financial Officer and guided by the Enterprise Risk Council, a cross-functional group of the Company’s business leaders representing key business functions that is co-chaired by our Chief Audit Executive.
The results of the enterprise risk evaluations and the status and operation of the Enterprise Risk Management program are presented to our Board of Directors, which oversees the Company’s enterprise-level risks.
2 unchanged sentences
In addition to leveraging the Company’s own information technology resources, our Incident Response and Cyber Threat Intelligence teams engage, as needed, third-party cybersecurity risk assessors and consultants to assist in recognizing threats, identifying security vulnerabilities and evaluating the impact of cybersecurity attacks and incidents when they occur.
−Removed: On a biennial basis, our DTI organization also engages external third-party experts to assess the Company’s cybersecurity control maturity across the organization and develops plans to address such experts’ recommendations.
+Added: On a biennial basis, our ATMOS also engages external third-party experts to assess the Company’s cybersecurity control maturity across the organization and develops plans to address such experts’ recommendations.
Our CDT function has processes to oversee and identify the risks of cybersecurity threats associated with third-party service providers and monitors and works to mitigate the impact of cybersecurity incidents encountered by our third-party service providers.
Upon becoming aware of cybersecurity incidents encountered by our third-party service providers, the CDT function’s Incident Response and Cyber Threat Intelligence teams are deployed to evaluate and mitigate the impact of such incidents on our business.
+Added: In connection with our adoption of artificial intelligence (AI) tools in our business, including AI tools customized for our business and a variety of Amgen-built tools for use across applications, the Company established an AI Governance Council composed of cross-functional leadership that oversees the safe adoption of third-party AI services, including by establishing guardrails to reduce risks and allocating resources to provide staff training on the proper use of AI and responsible AI practices.
+Added: The AI Governance Council is co-sponsored by our Chief Compliance Officer and Senior Vice President, Artificial Intelligence & Data.
Despite our layered controls and cybersecurity efforts, the Company and its third-party vendors have experienced cyberattacks and information security vulnerabilities, and while such incidents have not had a material adverse effect on the Company , there can be no assurance that future cybersecurity attacks or incidents would not result in a material adverse effect on our business strategy, results of operations or financial condition.
14 unchanged sentences
government agencies and departments.
−Removed: Our DTI organization is led by, and our CISO is overseen by, our CIO, who has held roles of increasing responsibility within our information systems organization since 2001 and has developed his knowledge and skills in the cybersecurity area over the course of his career in information systems.
−Removed: Our inaugural Executive Vice President and Chief Technology Officer (CTO), effective as of the end of 2023, oversees our CIO.
−Removed: Prior to the establishment of the CTO role, our CIO was overseen by our Executive Vice President and Chief Financial Officer.
−Removed: As leaders of the DTI organization and CDT function, respectively, the Company’s CIO and CISO are informed about and monitor significant cybersecurity threats and incidents through the Company’s internal cybersecurity reporting structure.
+Added: Our CISO is overseen by our CIO, who has 27 years of experience in information systems (including over 14 years at the Company and more than 6 years as a senior technology executive outside of Amgen), and holds a Computer Information Systems B.S.
+Added: and an Information Technology Management MBA.
+Added: Our Executive Vice President and Chief Technology Officer (CTO) leads our ATMOS function and oversees our CIO.
+Added: As leaders of the Technology and CDT functions within ATMOS, respectively, the Company’s CIO and CISO are informed about and monitor significant cybersecurity threats and incidents through the Company’s internal cybersecurity reporting structure.
Our CDT team is responsible for monitoring and detecting cybersecurity threats and incidents.
3 unchanged sentences
Our CISO and/or his senior team leaders, in addition to our CIO and CTO, also provide regular reports to executives leading our Finance, Compliance, Law and Human Resources functions on potentially significant cybersecurity incidents and the progress made towards mitigation and remediation of those incidents.
−Removed: These leaders oversee reporting to our CRCC and Audit Committee, and reporting of such cybersecurity incidents are included in the course of regular meetings of such committees.
−Removed: Additionally, in appropriate circumstances, reporting of potentially significant cybersecurity incidents are made directly to the leaders of our CRCC and Audit Committee or directly to the Board of Directors outside of their regular meeting schedule.
−Removed: Further, in support of our internal controls, our CISO also reviews cybersecurity matters and trends with our accounting and law functions on a quarterly basis.
+Added: These leaders oversee reporting to our CRCC and Audit Committee, and reporting of such cybersecurity incidents is included in the course of regular meetings of such committees.
+Added: Additionally, in appropriate circumstances, reporting of potentially significant cybersecurity incidents is made directly to the leaders of our CRCC and Audit Committee or directly to the Board of Directors outside of their regular meeting schedule.
+Added: Further, in support of our internal controls, our CISO also reviews cybersecurity matters and trends with our Accounting and Law functions at least on a quarterly basis.
Information Systems Acquired from Horizon Therapeutics plc
On October 6, 2023, we completed our acquisition of Horizon.
−Removed: Horizon’s legacy information systems are currently maintained separately from Amgen’s preexisting information system infrastructure.
−Removed: After we are able to fully evaluate Horizon’s legacy information systems, protocols and practices, we plan to operationally integrate the legacy Horizon systems into our own, and these integrated systems will then be subject to Amgen’s cybersecurity risk management structure and strategy.
−Removed: While we integrate these systems, our CISO and CDT function are engaging in cybersecurity risk management activities, and any cybersecurity incidents detected on the legacy Horizon information systems are assessed, mitigated and remediated by our CDT function’s Incident Response and Cyber Threat Intelligence teams and reported in accordance with the governance processes detailed above.
+Added: Certain Horizon legacy information systems are maintained separately from Amgen’s preexisting information system infrastructure.
+Added: We are continuing to operationally integrate and transition the legacy Horizon systems into our own, with the integrated systems becoming subject to Amgen’s cybersecurity risk management structure and strategy.
+Added: While we are integrating these systems, our CISO and CDT function are engaging in cybersecurity risk management activities, and any cybersecurity incidents detected on the legacy Horizon information systems are assessed, mitigated and remediated by our CDT function’s Operations, Incident Response and Cyber Threat Intelligence teams and reported in accordance with the governance processes detailed above.
Risk Factors— Our efforts to collaborate with or acquire other companies, products, or technology, and to integrate the operations of companies or to support the products or technology we have acquired, may not be successful, and may result in unanticipated costs, delays or failures to realize the benefits of the transactions and Item 1A.
−Removed: Risk Factors— A breakdown of our information technology systems, cyberattack or information
−Removed: security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation.
+Added: Risk Factors— A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.