2 unchanged sentences
Risk Management and Strategy
−Removed: We have established a set of policies and procedures to assess, identify, and manage material risks from cybersecurity threats, codified in the Bausch Health Cybersecurity Program (the “Program”).
−Removed: The purpose of the Program is to establish a comprehensive framework intended to identify, manage, and where possible mitigate risks;
−Removed: prevent or identify and manage security incidents;
−Removed: protect our information assets, systems, and networks from potential threats;
−Removed: and enable a prompt response and recovery from cyber-attacks.
−Removed: The Program is based on the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”).
−Removed: The NIST CSF offers a framework for cybersecurity management, including asset identification, systems protection, threat detection, and incident response and recovery.
−Removed: In particular, our cybersecurity strategy, as set forth in the Program, uses NIST Special Publication 800-53, which covers the steps in the CSF that address security safeguards across five dimensions of information security (Identification, Protection, Detection, Response, and Recovery).
+Added: We have established a formal set of policies and procedures to identify, assess, manage and report on material risks derived from cybersecurity threats and vulnerabilities, codified in the Bausch Health Cybersecurity Program (the “Program”).
+Added: The purpose of the Program is to deploy a comprehensive framework designed to reasonably protect our information assets, systems, and networks from potential threats;
+Added: and enable a prompt response to cybersecurity events and, if necessary, recovery from cyber-attacks using a combination of risk management and cybersecurity frameworks.
+Added: The Program is based on the National Institute of Standards and Technology Cybersecurity Framework (“CSF”) version 2.0.
+Added: The CSF offers a framework for cybersecurity management, including program governance, asset and risk identification, systems protection, threat detection, and incident response and recovery.
+Added: In particular, our cybersecurity strategy, as set forth in the Program, uses the CSF to address security safeguards across six dimensions of information security (Govern, Identification, Protection, Detection, Response, and Recovery).
The Program guides the execution of our cybersecurity responsibilities for our digital infrastructure, including network security, endpoint security, data protection, incident response, awareness and training, compliance, and risk management.
The policies and procedures established pursuant to the Program include:
−Removed: • Risk Identification – Seeking to identify and manage cybersecurity risk to systems, assets, data, people, and capabilities using measures such as asset management and assessment of suppliers and third-party partners, including using audits and testing.
−Removed: • Protection – I mplementation of safeguards designed to ensure delivery of critical infrastructure services, including identity management and access control, security training, and use of protective technology.
−Removed: • Detection – Detection of the occurrence of a nomalies and cybersecurity events through monitoring and communication to appropriate personnel.
−Removed: • Response – Establishing appropriate responses when cybersecurity events are detected, including through response planning and establishment of communications channels.
−Removed: • Recovery – Seeking to ensure resilience and restore any capabilities or services that were impaired due to a cybersecurity incident, through recovery planning and other measures.
+Added: • Govern – Identify cybersecurity priorities and related outcomes as a component of the Company’s strategic planning processes.
+Added: • Identification – Identify and manage cybersecurity risk to systems, assets, data, people, and capabilities using measures such as asset management and assessment of suppliers and third-party partners , including using audits and testing.
+Added: • Protection – I mplementation of safeguards designed to ensure delivery of critical infrastructure services, including identity management and access control, security training, and use of protective technologies.
+Added: • Detection – Detection of the occurrence of a nomalies and cybersecurity events through logging, monitoring and communicating to appropriate personnel.
+Added: • Response – Establishing appropriate responses when cybersecurity events are detected, including response planning and leveraging communications channels.
+Added: • Recovery – R estore any capabilities or services that were impaired as a result of a cybersecurity incident, by executing documented recovery plans.
Pursuant to the Program, the Bausch Health Information Technology Security Department develops specific cybersecurity policies, procedures and guidelines.
4 unchanged sentences
Impact of cybersecurity risks on business strategy, results of operations or financial condition
−Removed: As of the date of this Form 10-K, there have been no cybersecurity incidents that have materially affected, or are likely to materially affect the Company’s business strategy, results of operations or financial condition.
+Added: While as of the date of this Form 10-K, there have been no cybersecurity incidents that have materially affected, or are likely to materially affect the Company’s business strategy, results of operations or financial condition, we have experienced cybersecurity incidents from time to time, and any future incidents have the potential to have a material adverse effect on our business strategy, results of operations and/or financial condition.
Please refer to “Risk Factors— Risks Relating to Information Technology—We have become increasingly dependent on information technology systems and infrastructure and any breakdown, interruption, breach or other compromise of our or our third-party service providers’ information technology systems could compromise sensitive information related to our business or prevent us from accessing critical information and subject us to liability or interrupt the operation of our business, which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares and/or debt securities to decline.” under Item 1A.
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.