Company: BLCO
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001860742-25-000004
Chunk: 251

Company: Bausch & Lomb Corp
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 251
---
 threats or incidents. 

53

When a cybersecurity threat or incident is identified, the Cybersecurity and Risk Management Team will perform a technical investigation which typically consists of the following phases: i.Detection, which includes identifying the threat or incident, gathering all available facts surrounding the matter and performing an initial analysis to determine its level of severity. If the incident is classified as “Severity 1,” the Materiality Committee, as defined below, is notified to further assess the matter.ii.Containment and Eradication, which includes determining the cause and vulnerabilities so that the threat or incident can be isolated and eliminated.iii.Recovery, which includes repairing the impacted systems, and if applicable, notifying and instructing impacted parties of next steps.iv.Post-Incident, which includes issuing a report summarizing the threat or incident, and the steps taken in assessing and eliminating the threat, as well as steps to implement to attempt to prevent similar future incidents.The Materiality Committee is responsible for assessing whether a threat or an incident has materially affected or is likely to materially affect the Company’s business strategy, results of operations or financial condition. The Materiality Committee considers both quantitative and qualitative factors. Once it is determined that a matter has had a material impact or it is reasonably likely to have a material impact on the Company, the Materiality Committee is required to immediately report the incident to the Disclosure Committee and Audit and Risk Committee (the "Audit Committee") of the Board of Directors (the “Board”).The Company emphasizes continuous risk evaluation and mitigation to improve the Cybersecurity Risk Management Program’s resilience and to instill a culture of vigilance across the Company's business. To promote employee awareness of best practices, the Company socializes policies and tips through its intranet site, sends regular phishing simulations, emails newsletters and hosts cybersecurity learning exercises, all in addition to standard company-wide cybersecurity awareness trainings. The Company also participates in various cybersecurity network memberships, including: •H-ISAC: a global cybersecurity best practice-sharing and threat intelligence network for health care stakeholders and •Domestic Security Alliance Council: a partnership between U.S. government agencies and private sector organizations that exchanges security and intelligence information.The Company has also implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers. The Company’s control over and ability to monitor the security posture of third parties with whom it does business remains limited and there can be no assurance that the Company can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third