Company: BKR
Filing Date: 2025-02-04
Form Type: 10-K
Source: 0001701605-25-000035
Chunk: 117

Company: Baker Hughes Co
Filing Date: 2025-02-04
Form: 10-K
Item: Item 1C
Chunk 117
---
ITEM 1C. CYBERSECURITY

RISK MANAGEMENT & STRATEGY

Overall Process

We protect our digital systems and data through a comprehensive cybersecurity management program, which includes a dedicated cybersecurity function, risk assessments, policies and procedures, and technical measures and related services from third party service providers. We have a dedicated Chief Information Security Officer ("CISO") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. As part of our cybersecurity management program, we operate a CFC to monitor both internal and external cybersecurity threats, conduct initial assessment of severity, coordinate incident response resources, reduce incident response time, and shift toward a proactive cyber-defense model, which includes a dedicated threat intelligence program that leverages custom intelligence 

Baker Hughes Company 2024 Form 10-K | 27

platforms as well as industry specific professional associations and ongoing threat hunting. Through our cybersecurity risk management program, we monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and countermeasures made to defend against such threats.

We have established policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to events that may jeopardize the company digital information or systems, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities to triage, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations and mitigate brand and reputational damage. We conduct regular tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through external and internal reporting channels.

Enterprise Risk Management Process Integration

Cybersecurity risk management processes are an integral part of our enterprise risk management, which is overseen by the Audit Committee of the Board. Our processes include periodic program maturity assessments, ongoing information technology risk assessments, and third-party security risks assessments.

Our cybersecurity risk management efforts have also been integrated into the overall Enterprise Risk Management ("ERM") process, which includes assessment of cybersecurity risks that could result in significant operational disruption to the Company, such as production disruption, business downtime, loss of