7 unchanged sentences
To evaluate the progress of its activities, our ATMOS function uses various industry and regulatory frameworks as guides to assess the state of the Company’s cybersecurity program maturity and controls, including our organizational, people, physical and technological controls.
−Removed: The CDT team also conducts reviews and evaluations of our cybersecurity resilience program with Amgen’s Cybersecurity & Digital Trust Governance Council (which includes leaders from CDT, Worldwide Compliance and Business Ethics, Regulatory Affairs, Operations, R&D, Global Commercial Operations, Corporate Audit, Law and Business Development functions).
+Added: The CDT team also conducts reviews and evaluations of our cybersecurity resilience program with Amgen’s Cybersecurity & Digital Trust Governance Council (which includes leaders from CDT, Worldwide Compliance and Business Ethics, Regulatory Affairs, Operations, R&D, Global Commercial Operations, Corporate Audit, Finance, Law and Business Development functions).
Our cybersecurity risk management program is considered by and integrated into our Company-wide Enterprise Risk Management program and shares common methodologies, reporting channels and governance processes that apply across the Enterprise Risk Management program to that of other enterprise level risks (such as product development, safety and surveillance, financial and intellectual property risks).
10 unchanged sentences
The AI Governance Council is co-sponsored by our Chief Compliance Officer and Senior Vice President, Artificial Intelligence & Data.
−Removed: Despite our layered controls and cybersecurity efforts, the Company and its third-party vendors have experienced cyberattacks and information security vulnerabilities, and while such incidents have not had a material adverse effect on the Company , there can be no assurance that future cybersecurity attacks or incidents would not result in a material adverse effect on our business strategy, results of operations or financial condition.
+Added: Despite our layered controls and cybersecurity efforts, the Company and its third-party vendors have experienced cyberattacks and information security vulnerabilities, and while such incidents have not had a material adverse effect on the Company , there can be no assurance that future cybersecurity attacks or incidents would not result in a material adverse effect
+Added: on our business strategy, results of operations or financial condition.
For examples of such matters and a discussion of the risks that we face, see Item 1A.
25 unchanged sentences
Further, in support of our internal controls, our CISO also reviews cybersecurity matters and trends with our Accounting and Law functions at least on a quarterly basis.
−Removed: Information Systems Acquired from Horizon Therapeutics plc
−Removed: On October 6, 2023, we completed our acquisition of Horizon.
−Removed: Certain Horizon legacy information systems are maintained separately from Amgen’s preexisting information system infrastructure.
−Removed: We are continuing to operationally integrate and transition the legacy Horizon systems into our own, with the integrated systems becoming subject to Amgen’s cybersecurity risk management structure and strategy.
−Removed: While we are integrating these systems, our CISO and CDT function are engaging in cybersecurity risk management activities, and any cybersecurity incidents detected on the legacy Horizon information systems are assessed, mitigated and remediated by our CDT function’s Operations, Incident Response and Cyber Threat Intelligence teams and reported in accordance with the governance processes detailed above.
−Removed: Risk Factors— Our efforts to collaborate with or acquire other companies, products, or technology, and to integrate the operations of companies or to support the products or technology we have acquired, may not be successful, and may result in unanticipated costs, delays or failures to realize the benefits of the transactions and Item 1A.
−Removed: Risk Factors— A breakdown of our information technology systems, cyberattack or information security breach could significantly compromise the confidentiality, integrity and availability of our information technology systems, network-connected control systems and/or our data, interrupt the operation of our business and/or affect our reputation.
+Added: In 2025, we substantially transitioned or decommissioned the technology systems from the legacy Horizon environment to the Amgen environment.
+Added: The remaining systems are being monitored by the Amgen cybersecurity team in accordance with the governance processes detailed above.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.