2 unchanged sentences
Cybersecurity Strategy and Risk Management
−Removed: Our comprehensive cybersecurity program is supported by policies and procedures designed to protect our systems and operations as well as the sensitive personal information and data of our clients and customers from foreseeable cybersecurity threats.
−Removed: This program is an integral component of our enterprise risk management program .
+Added: Cybersecurity is a core element of our enterprise risk management strategy.
+Added: Safeguarding business information, intellectual property, and the data of customers, patients, employees and business partners is vital for operational continuity, regulatory compliance and sustaining stakeholder trust.
+Added: Our comprehensive cybersecurity program is supported by policies and procedures designed to protect our systems and operations, as well as sensitive personal information and data, fro m foreseeable cybersecurity threats .
Core to our security model is our defense-in-depth framework, comprising multiple layers of processes and technologies that help prevent, detect and respond to threats.
4 unchanged sentences
(iii) security operations and monitoring;
+Added: (iv) change management;
(v) disaster recovery/business continuity;
9 unchanged sentences
In addition to the NIST framework, we leverage the International Organization for Standardization 27001 and 27002 standards.
−Removed: Our information protection policies and standards are informed by NIST 800-53b, moderate-level security control baseline requirements.
−Removed: To enhance our preparedness and practice our collective cybersecurity response capabilities, we conduct tabletop exercises with leaders, stakeholders, subject matter experts and certain executives that are developed in partnership with external security experts.
−Removed: These events are designed to exercise and engage some of the most critical areas of cybersecurity incident response and preparedness through an interactive/evolving, simulated scenario.
+Added: To enhance our preparedness and practice our collective cybersecurity response capabilities, we conduct tabletop exercises with leaders, stakeholders, subject matter experts and certain executives.
+Added: These events are developed in partnership with external security experts and designed to exercise and engage some of the most critical areas of cybersecurity incident response and preparedness through an interactive and evolving simulated scenario.
In addition to these internal measures, the effectiveness of components of our overall cybersecurity program is frequently evaluated by external third parties, which includes work performed over various levels of control assessments for specific business lines and core processes.
−Removed: These include Health Information Trust Alliance for health care data security, PCI DSS for payment security and System Organization Controls 2 for information security and related controls for specific business lines and core processes.
+Added: These include Health Information Trust Alliance ("HITRUST") for health care data security, PCI DSS for payment security, and System Organization Controls 2 ("SOC 2") for information security and related controls for specific business lines and core processes.
We also perform an annual maturity assessment and benchmark our security controls to identify opportunities to strengthen our cybersecurity program.
2 unchanged sentences
The GIRP's incident handling procedures dictate our actions during each phase of an incident, including the assembly of a broad, cross-functional Computer Security Incident Response Team, the formulation of a response, and post-incident reviews and corrective actions.
−Removed: Our information protection department maintains a risk register that is used to manage cybersecurity risks associated with its business activities, technology assets and its interaction with business, information technology and security parties, internal and external.
+Added: Our information protection department maintains a risk register that is used to manage cybersecurity risks associated with its business activities, technology assets, and its interaction with internal and external business, information technology and security parties.
Cybersecurity risks are also periodically reviewed by Enterprise Risk Management to ensure appropriate oversight of cybersecurity risk management activities.
−Removed: Suppliers that have access to, host or transmit our data are contractually required to comply with our Security Policies and Standards.
+Added: Suppliers that access, host or transmit our data are contractually required to comply with our Security Policies and Standards.
Additionally, suppliers may be subject to periodic security audits or risk assessments, which include security questionnaires, security capabilities and maturity assessments, controls evidence reviews, application vulnerability assessments, public internet presence monitoring, and alignment reviews with service-specific industry standards.
3 unchanged sentences
As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.
−Removed: That said, as discussed more fully under Part I, Item 1A "Risk Factors – Strategic and Operational Risks – As a large global health company, we and our vendors are subject to cyberattacks or other privacy or data security incidents.
−Removed: If we are unable to prevent or contain the effects of any such attacks, or fail to ensure vendors do the same, we may suffer exposure to substantial liability, reputational harm, loss of revenue or other damages," the sophistication of cybersecurity threats continues to increase, and the preventive actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may become insufficient.
−Removed: Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all attacks of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.
+Added: However, future cybersecurity threats or incidents could materially affect us, including our business strategy, results of operations or financial condition.
+Added: For more information on our cybersecurity-related risks, see Part I, Item 1A "Risk Factors – Operational Risks – As a large global health company, we and our vendors are subject to cyberattacks or other privacy or data security incidents.
+Added: If we are unable to prevent or contain the effects of any such attacks, or fail to ensure vendors do the same, we may suffer exposure to substantial liability, reputational harm, loss of revenue or other damages."
Cybersecurity Governance
−Removed: Our Board has ultimate oversight over our privacy and cybersecurity programs and strategy and is responsible for ensuring that we have risk management policies and processes in place to meet and mitigate evolving risks and threats.
−Removed: Certain members of the Board have cybersecurity certifications.
−Removed: The Board executes this oversight directly and through both the Audit Committee, for cybersecurity purposes, and the Compliance Committee, for privacy purposes.
−Removed: In these capacities, these committees are regularly briefed by the Global Chief Information Security Officer ("GCISO") and Chief Privacy Officer on cybersecurity and privacy matters .
−Removed: These briefings are designed to provide visibility about the identification, assessment and management of critical risks, audit findings, and management's risk mitigation strategies.
−Removed: Additionally, these briefings include information about current trends in the environment, incident preparedness, artificial intelligence and various components of our cybersecurity and privacy programs.
+Added: Our Board of Directors (the "Board") has ultimate oversight over our privacy and cybersecurity programs and strategy and is responsible for ensuring that we have risk management policies and processes in place to meet and mitigate evolving risks and threats.
+Added: Certain members of our Board have cybersecurity certifications.
+Added: Throughout 2025, the Board executed this oversight directly and through both the Audit Committee, for cybersecurity purposes, and the Compliance Committee, for privacy purposes.
+Added: In these capacities, these committees were regularly briefed by the Global Chief Information Security Officer ("GCISO") and Chief Privacy Officer on cybersecurity and privacy matters .
+Added: These briefings were designed to provide visibility about the identification, assessment and management of critical risks, audit findings, and management's risk mitigation strategies.
+Added: Additionally, these briefings included information about current trends in the environment, incident preparedness, AI, and various components of our cybersecurity and privacy programs.
On an annual basis, the Board reviews our cybersecurity program, including the threat landscape and related controls, and periodically conducts cybersecurity tabletop exercises.
Our dedicated cybersecurity team is led by our GCISO.
−Removed: Our current GCISO joined the Company in October 2023 and works closely with senior management to develop and innovate the cybersecurity strategy and risk management.
−Removed: Prior to joining the team, our GCISO held senior information security roles at other global organizations where this individual defined information security strategies, built global information security programs, implemented cybersecurity capabilities that protect consumers, wholesale partners and brands, and oversaw the security of a global payment network, a corporate network and digital assets.
+Added: Our current GCISO joined the Company in October 2023 and works closely with senior management to develop and innovate the cybersecurity and risk management strategies.
+Added: Prior to joining the team, our GCISO held senior information security roles at other global organizations, where this individual defined information security strategies;
+Added: built global information security programs;
+Added: implemented cybersecurity capabilities that protect consumers, wholesale partners and brands;
+Added: and oversaw the security of a global payment network, a corporate network and digital assets.
+Added: Beginning in 2026, oversight of cybersecurity matters has transitioned to the Board's Finance & Technology Committee.
+Added: The Finance & Technology Committee now receives similar updates on cybersecurity and information protection programs from the GCISO as described above.
+Added: Throughout 2025, the Compliance Committee, now the Audit & Compliance Committee, oversaw privacy risks and related matters, including through regular updates from our Chief Compliance and Risk Officer.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.