4 unchanged sentences
In addition, the Cybersecurity Program seeks to incorporate consideration of cybersecurity risk into our product development, business strategy, financial planning and capital allocation decisions.
−Removed: The Cybersecurity Program is currently overseen by the Board of Directors (Board) and is managed by a dedicated Chief Information Security Officer (CISO) , who in turn reports to the Chief Information Officer (CIO), who currently reports to the CEO.
−Removed: The CISO's organization has oversight responsibilities for cybersecurity strategy, policy, standards, architecture and processes for the security of our corporate and manufacturing enterprise network, information assets and medical device technologies.
−Removed: Our current CISO has over 20 years of experience in cybersecurity and risk and technology management, and has held numerous positions in the cybersecurity sector, including serving as Global Cyber Risk Officer at another Fortune 500 medical products and equipment company and CISO at other healthcare companies and health care delivery organizations.
−Removed: Our current CIO has over 30 years of experience in information technology and has served in a number of professional services leadership roles, including as CIO over the past 15 years at three companies.
+Added: The Cybersecurity Program is currently overseen by the Board of Directors (Board) and is managed by our Chief Information Officer (CIO) , who is currently serving as our interim Chief Information Security Officer (CISO) while we complete the search for a permanent CISO.
+Added: The CISO's organization is responsible for cybersecurity strategy, policy, standards, risk-management architectures, and processes for the security of our corporate and manufacturing enterprise network, information assets and medical device technologies.
+Added: Additionally, this organization provides governance and guidance related to secure-by-design principles and secure development practices for medical technologies.
+Added: Our CIO has over 30 years of experience in information technology and has served in a number of professional services leadership roles, including as CIO over the past 15 years at three companies.
The CISO’s organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated as necessary to align with the changing threat landscape, our evolving business needs as well as global regulatory requirements.
−Removed: In addition, from time to time, we also utilize external auditors and assessors to help evaluate our Cybersecurity Program, including conducting penetration testing and vulnerability, risk and maturity assessments.
+Added: In addition, from time to time, we also utilize external auditors, assessors, and pen-testers to help evaluate the maturity of our Cybersecurity Program, including conducting penetration testing and vulnerability, risk, and maturity assessments.
We also actively engage with industry experts, regulatory agencies, advocacy groups, industry peers, intelligence, and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our Cybersecurity Program and to stay abreast of the emerging cybersecurity landscape.
We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce the time it takes to detect a cybersecurity threat and improve our recoverability capabilities.
−Removed: These defenses include
−Removed: the ongoing monitoring of our systems (including with the assistance of third-party vendors), conducting response and recovery exercises with employees and senior management (including our executive officers) to promote awareness of related matters and improve internal processes, and engaging with external cybersecurity rating agencies that assess our cyber risk.
−Removed: In addition, to help promote privacy and security awareness throughout the company, the CISO maintains a Cyber Awareness and Engagement Program.
−Removed: As part of this program, all employees with a Baxter email address receive annual training on the recognition and prevention of cybersecurity threats as well as training on how to report suspicious activity or potential breaches through the appropriate channels.
+Added: These defenses include the ongoing monitoring of our systems (including with the assistance of third-party vendors), conducting response and recovery exercises with employees and senior management (including our executive officers) to promote awareness of related matters and improve internal processes, and engaging with external cybersecurity rating agencies that assess our cyber risk.
+Added: In addition, to help promote privacy and security awareness throughout the company, the CISO's organization maintains a Cyber Awareness and Engagement Program.
+Added: As part of this program, all stakeholders (including Baxter employees and contractors) with a Baxter email address receive annual training on the recognition and prevention of cybersecurity threats as well as training on how to report suspicious activity or potential breaches through the appropriate channels.
Our Cyber Awareness team communicates cybersecurity best practices to our employees through internal communications, including the company intranet, newsletters, and global virtual seminars, and also hosts ongoing cybersecurity awareness campaigns, including phishing simulations.
1 unchanged sentence
Third-party cybersecurity risks (including reputational ones) are assessed by evaluating the third party's security practices (including those associated with data protection), compliance with applicable regulations and planning associated with business continuity and incident detection and response.
−Removed: The Cybersecurity Program maintains a cybersecurity governance and oversight framework that seeks to drive accountability for all levels of employees, including senior management and executive officers.
−Removed: Cybersecurity matters are generally managed by a combination of working groups that report to the cybersecurity compliance committee and ultimately the cybersecurity executive oversight committee, as appropriate.
−Removed: Our cross functional cybersecurity compliance committee, which is led by the CISO, is composed of members of senior management, including the CIO, and reviews matters such as cybersecurity escalations, critical remediations and disclosure recommendations.
−Removed: The output from the cybersecurity compliance committee meetings is discussed at meetings of Baxter’s cybersecurity executive oversight committee, which is led by the CISO and includes the CIO and other members of management.
−Removed: In February 2024, we amended the charters of the Audit Committee and Quality and Regulatory Compliance (QRC) Committee of our Board to provide for the realignment of oversight over the company’s innovation strategy and cybersecurity to the full Board, as these responsibilities now sit within the vertically integrated segments and are part of the business strategies themselves.
−Removed: The Board oversees information technology functions generally, including product related cybersecurity matters (which had previously been subject to the oversight of the QRC Committee).
−Removed: The Audit Committee is responsible for the oversight of certain significant cybersecurity incidents, including ones related to our products and services and receives related updates from management on those incidents .
−Removed: Consistent with this oversight responsibility, the Audit Committee is responsible for reviewing proposed disclosures in connection with any material cybersecurity incident consistent with our disclosure obligations under Item 1.05 of Form 8-K.
−Removed: The full Board receives periodic updates on information technology and cybersecurity matters from company management (including the CIO and CISO) and external advisors from time to time and the Audit Committee receives periodic updates (including as part of continuing director education) on the evolving cybersecurity landscape and regulatory reporting requirements.
−Removed: The CISO maintains and annually updates a Cybersecurity Incident Response Plan which is a guide for our Cyber Security Incident Response Team and business to respond to cybersecurity incidents in a coordinated manner.
−Removed: Additionally, the CISO, in partnership with a third-party consultant, facilitates periodic cyber-crisis tabletop exercises with members of senior management (including our executive officers) to help us prepare for the occurrence of a significant cybersecurity event and our related response activities.
+Added: The Cybersecurity Program and the CISO's organization maintain a cybersecurity governance and oversight framework that seeks to drive accountability for all levels of employees, including senior management and executive officers.
+Added: Cybersecurity matters are generally managed by a combination of working groups, the cybersecurity compliance committee and ultimately the cybersecurity executive oversight committee, as appropriate.
+Added: Our cross functional cybersecurity compliance committee is led by the CISO, is composed of members of senior management, including the CIO, and reviews matters such as cybersecurity escalations, critical remediations, and disclosure recommendations.
+Added: The output from the cybersecurity compliance committee meetings is discussed at meetings of Baxter’s cybersecurity executive oversight committee, which is also led by the CISO's organization and includes the CEO, other members of the CEO's executive management including the CIO, Chief Financial Officer and General Counsel.
+Added: The Board oversees information technology functions generally, including product related cybersecurity matters as well as our use of artificial intelligence (whether internally or in our products and services).
+Added: The Audit Committee of the Board is responsible for the oversight of certain significant cybersecurity incidents, including ones related to our products and services, and, in the event of a significant cybersecurity incident, receives related updates from management on those incidents .
+Added: Consistent with this oversight responsibility, the Audit Committee is responsible for reviewing proposed disclosures in connection with any material cybersecurity incident consistent with our disclosure
+Added: obligations under Item 1.05 of Form 8-K.
+Added: The full Board receives periodic updates on information technology and cybersecurity matters from management (including the CIO and CISO) and external advisors from time to time, and the Audit Committee receives periodic updates (including as part of continuing director education) on the evolving cybersecurity and artificial intelligence landscapes and regulatory reporting requirements.
+Added: We maintain and annually update a Cybersecurity Incident Response Plan, which is a guide for our Cyber Security Incident Response Team and business to respond to cybersecurity incidents in a coordinated manner.
+Added: Additionally, we, in partnership with a third-party consultant, facilitate periodic cyber-crisis tabletop exercises with members of senior management (including our executive officers) to help us prepare for the occurrence of a significant cybersecurity event and our related response activities.
Cybersecurity risks and threats, including any previous cybersecurity incidents, have not materially impacted us or our operations to date .
However, we cannot provide any assurance that we will not be subject to a material cybersecurity incident in the future.
−Removed: See "Risks Relating to Our Operations—Breaches and breakdowns affecting our information technology systems or protected information, including from cyber security breaches and data leakage, could have a material adverse effect on our business, results of operations, financial condition, cash flows, reputation and competitive position” in Item 1A.
+Added: See "Risks Relating to Our Operations—We may experience breaches and breakdowns affecting our information technology systems or protected information, including from obsolescence, cyber security breaches and data leakage” in Item 1A.
Risk Factors of this Annual Report on Form 10-K for a discussion of cybersecurity-related risks.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.