2 unchanged sentences
Cybersecurity Risk Management and Strategy
−Removed: We rely on industry-standard software applications, IT systems, computing infrastructure, and cloud service providers (collectively referred to as "Information Systems") to perform essential operations.
−Removed: Many of these systems are managed, hosted, provided, or utilized by third parties, including BD, to support our business activities.
−Removed: We have implemented administrative, physical, and technical safeguards and processes to assess, identify, and manage material risks from known cybersecurity threats to our Information Systems and operations.
+Added: We rely on industry-standard software applications, IT systems, computing infrastructure, enterprise resource planning systems, and cloud service providers (collectively referred to as "Information Systems") to perform essential operations.
+Added: Many of these systems are managed, hosted, provided, or utilized by third parties, to support our business activities.
+Added: We have implemented administrative, physical, and technical safeguards and processes to assess, identify, and manage material risks from known cybersecurity, information, or data security risks and threats to our Information Systems and operations.
However, our Information Systems could be disrupted, degraded, destroyed, or manipulated intentionally or accidentally by our employees, third parties with authorized access, or cyber threat actors, which could negatively and adversely impact key business processes.
1 unchanged sentence
Additionally, we and our third-party providers have experienced and expect to continue experiencing phishing attempts, network scanning attempts, and other unauthorized access attempts to our computers, Information Systems, networks, and devices.
−Removed: These increasingly sophisticated attacks are carried out by groups and individuals with various motives and expertise, including state and quasi-state actors, criminal groups, hackers, and others.
+Added: These increasingly sophisticated attacks are carried out by groups and individuals with various motives and expertise, including, but not limited to, state and quasi-state actors, criminal groups, hackers, and others.
Such attacks could result in the loss of confidentiality, integrity, and/or availability of our data and Information Systems.
4 unchanged sentences
This includes assessing internal and external threats to the security, confidentiality, integrity, and availability of Embecta and third party provider data and systems, as well as other risks to our operations.
−Removed: Embecta utilizes the ISO 27001 framework, which incorporates the National Institute of Standards and Technology and Center for Internet Security frameworks, and various risk management frameworks to proactively evaluate its cybersecurity controls, risks, and overall program effectiveness.
+Added: Embecta utilizes the ISO 27001 and 42001 frameworks, which incorporates the National Institute of Standards and Technology and Center for Internet Security frameworks, and various risk management frameworks to proactively evaluate its cybersecurity controls, risks, and overall program effectiveness against emerging risks including AI.
As part of our risk management process, we engage external providers to conduct periodic internal and external penetration testing and security assessments.
2 unchanged sentences
Enterprise cybersecurity policies undergo an annual review and approval by our Information Security Risk Committee (“ISRC”).
−Removed: Embecta has established a Cyber Security Incident Response Team, a cross-functional team composed of representatives from our Information Technology, Information Security, Product Security, Privacy, Legal, and Human Resources groups.
+Added: Embecta has established a Cyber Security Incident Response Team, a cross-functional team composed of representatives from our Information Technology, Information Security, Research and Development, Privacy, Legal, and Human Resources groups.
This team is responsible for the response to security threats by implementing our detailed incident response plan.
3 unchanged sentences
Our ERM framework is overseen by the Audit Committee and Board of Directors.
−Removed: Our Chief Information Officer ("CIO") and Vice President of IT Infrastructure and Security ("VP IT") are responsible for updating the Audit Committee and Board of Directors on Embecta’s cyber risk.
+Added: Our Chief Information Officer ("CIO") and Vice President, CISO & IT Infrastructure and Security ("VP IT") are responsible for updating the Audit Committee and Board of Directors on Embecta’s cyber risk.
The CIO and VP IT have oversight of cybersecurity strategy, policy, standards, architecture, and processes that protect Embecta’s enterprise network, Information Systems and information assets, and product technologies.
5 unchanged sentences
The VP IT is responsible for all aspects of our cybersecurity program, including cybersecurity engineering and architecture, cybersecurity operations, monitoring, incident response, threat intelligence, identity and access management, cybersecurity risk and compliance, and vulnerability management.
−Removed: Our VP IT reports to our CIO, who has over twenty years of experience in information technology and process leadership, including leading teams with global cybersecurity responsibilities.
+Added: Our VP IT reports to our CIO, who brings over 30 years of diverse strategic and operational experience in IT management, process leadership, digital, and technology modernization.
Our CIO reports to the Chief Financial Officer.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.