CASE STUDY

A Journey to Empowered Risk Management

We had the pleasure of speaking with a remarkable customer the other day. Intuitive
Surgical develops, manufactures, and markets robotic products designed to improve
clinical outcomes of patients through minimally invasive surgery. We spoke with Doug
Phan, Information Security Compliance, Risk and Governance leader, about hisorganization’s journey.
Earlier this year, Intuitive Surgical migrated from a hosted environment for their Archer
platform to a Software as a Service (SaaS) deployment model. This step represents
new sophistication and empowerment in Intuitive Surgical’s approach to corporate
governance and risk management.

Customer Profile

About SaaS

• Founded in 1995

SaaS is software that is delivered and managed remotely via the internet. Archer’s SaaS
customers pay a monthly subscription to use the platform. The subscription also includes
all product upgrades and security updates, as well as instant access to every new productinnovation Archer makes.

• $5.71 billion in assets

Since Archer launched SaaS as an option in 2019, a growing number of our customers
have migrated to our SaaS deployment model, which not only provides access to theArcher use cases each customer purchases, but also includes customer and infrastructure
support, automatic version upgrades and immediate access to new product features andfunctions. Over 85% of new Archer customers are now choosing the SaaS deployment
model for convenient access to regular product upgrades and ongoing innovation.

Before Archer
In our recent conversation, Doug described their business. “Our company is in healthcare,which is a lifesaving kind of business,” he told us. We manufacture devices that enable
surgeons to perform non-intrusive surgery completely remotely. We deploy worldwide.”• Headquarters inSunnyvale, CA• 9,700+ employees

Doug told us his organization’s products are fascinating from a technological perspective,
and important from a societal perspective as well. We can all acknowledge the healthcare
advantages of robotic surgery and of having access to the right surgeon at the right time,
free from the prohibitors of time and space.
As so many other businesses do, Intuitive Surgical started its risk management efforts
with spreadsheets. Office productivity software was readily available to the resources
who possessed the skills to assemble and maintain their initial risk register. Doug told
us, “We used to do it all with Excel, where users managed the data in matrices, but you
couldn’t get access to it. The data was hard to access for many stakeholders, and you
had to know what you were doing to work with the spreadsheets.”

Selecting Archer Hosted“Our relationship with Archer is about three years old,” Doug told us. “We have a pretty
high standard. I’m part of the information technology security organization, and wecompleted a seven-month selection process when we decided to implement risk
management software. We put Archer through a drill where we looked at several
leading vendors in the space. We created a shortlist from Gartner’s magic quadrant
and developed our request for proposals and proof of concept. We definitely picked
the right product.”“One of our criteria was to have the ability to create our solution, one that fits ourbusiness,” Doug added. “For example, the regulatory compliance use case – when we
did the audit and control testing, we found it had the end-to-end solution we needed.”“We saw that we’d come a long way from convoluted Excel spreadsheets,” Doug remarked“We put in a lot of time at the beginning, working with Archer’s consulting team to build
the right foundation. And I believe we have done so, because with that foundation,
incrementally deploying solutions is something that we could do very quickly. During ourtime using the hosted deployment model, we worked closely with Archer’s consulting
team and support organization. Any time we had to make a change, migrations wereflawlessly executed.”

Migrating to Archer SaaS
A few years later, Intuitive Surgical learned about the advantages of a SaaS deployment
model and was drawn to migrate to SaaS for regular upgrades and ongoing accessto innovation. Their collaborations with Archer’s consulting and support teams in ahosted environment had given them confidence that migration to SaaS wouldn’t beunduly disruptive.
These dates tell the story: Intuitive Surgical’s migration to SaaS project kicked off onJune 14 of this year; final migration to the production environment was completed byJuly 21 – a mere six weeks later.
Doug observed: “From planning through to the execution, I’m very impressed with themethodology Archer had in place. The implementation team from Archer walked us
through. It was very methodical, very efficient.”

A Journey to Empowered Risk Management | 2

Doug explained he’s been in security auditing for over fifteen years. “So, when I saw thedocumentation that Archer provided me, I said ‘what?’ I was so impressed…technicalfolks, we know documentation, right?” He described how Archer Advisory Consultants
Wesley Stinson and David Freeman provided procedural documentation and demonstrated
how the implementation met all of Intuitive Surgical’s requirements. “It was impressive.
I’ve never seen any group coming in from operational services that has documentationand methodology like this. You guys are genius!”
And system performance? “Much better,” Doug said. “We’re really looking forward tobenefiting from all of the fruits of the Archer platform on SaaS.”

Life with Archer on SaaS

“It was impressive. I’ve neverseen any group coming infrom operational services
that has documentationand methodology like this.
You guys are genius!
Doug Phan,
Information Security Compliance,
Risk and Governance Leader
Intuitive Surgical“Now,” Doug said, “everything is securely managed at our fingertips. Everything we do isavailable on the platform – we don’t memorize anything. This is our entire third-party
practice, all of our documentation, audits and assessments, all of our dashboards, andwe were thrilled to provide management with that. Everything’s online.””

With SaaS at the foundation, Intuitive Surgical is empowered with constant innovations
and regular upgrades to the platform. They’ve gained the flexibility to deploy solutions
incrementally. For example, Doug’s team built a risk register for the infrastructure teamin just a few weeks.
Doug had more praise for our team: “Our exception on-demand applications (ODAs)
are very sophisticated now from the workflow, thanks to the consulting team who helped
us to build it. We just bought Archer Engage for Vendors after seeing the demo. We bought
every single module we saw, including the publication application for regulatory
and compliance.”
He very generously added: “If you have any prospects that are considering SaaS, youcan use us as a reference, and I will be glad to do that.”
We started this post by saying we had the pleasure of speaking with Doug, and hisremarks praising our product and our colleagues were very gratifying. Here at Archer,we derive enormous satisfaction from supporting clients who contribute so much tothe world.

Discover More
Archer is a leading provider of integrated risk management (IRM) solutions that enable customers to improve strategic decisionmaking and operational resilience with a modern technology platform that supports qualitative and quantitative analysis driven
by both business and IT impacts. As true pioneers in GRC software, Archer remains solely dedicated to helping customers manage
risk and compliance domains, from traditional operational risk to emerging issues such as ESG. With over 20 years in the risk
management industry, the Archer customer base represents one of the largest pure risk management communities globally, withmore than 1,200 customers including more than 50% of the Fortune 500.
Visit www.ArcherIRM.com.

©2022 Archer Technologies LLC. All rights reserved. Archer and the Archer logo are registered trademarks or trademarks of ArcherTechnologies LLC in the United States and other countries. All other trademarks are the property of their respective owners. Archerbelieves the information in this document is accurate. The information is subject to change without notice. 11/22 Case Study.