Company: BKR
Filing Date: 2025-02-04
Form Type: 10-K
Source: 0001701605-25-000035
Chunk: 118

Company: Baker Hughes Co
Filing Date: 2025-02-04
Form: 10-K
Item: Item 1C
Chunk 118
---
 containment or other operation interruptions, as well as risks that could have significant reputational and compliance/regulatory impact. Cybersecurity risks identified and tracked through our ERM risk register have assigned risk owners at the executive leadership level and risk delegates who are responsible to identify and manage risk mitigation actions. Key risk indicators are updated quarterly by risk delegates and communicated to our executive leadership and the Audit Committee.

We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, and program enhancements. We also include cybersecurity training as part of our required annual employee training program. In addition, cybersecurity and privacy training and awareness is integrated and continues throughout the year, utilizing various delivery methods such as phishing campaigns, training sessions, and informational articles.

Third Party Security Experts

We engage third party security experts to supplement our internal CFC team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.

Identification of Threats Associated with Third Parties

Baker Hughes utilizes a third-party risk management ("TPRM") program to identify, assess, monitor, and mitigate risks associated with suppliers and vendors, including cybersecurity risks. We conduct initial risk assessments of third-party suppliers and service providers based on various factors to classify each into a risk category. Our TPRM program is designed to apply our most rigorous processes to those suppliers and service providers that are classified into the highest risk category. These processes include due diligence assessments of third-party suppliers and service providers that have access to Baker Hughes networks, confidential information, and information systems in order to assess the risks from cybersecurity threats that could impact our suppliers and third-party service providers. We leverage external partners to assist with the regular assessment of our top priority suppliers and third-party service providers to identify, review and address risks, including deeper reviews of their 

Baker Hughes Company 2024 Form 10-K | 28

cybersecurity controls. We track the identified deficiencies and include with other cybersecurity metrics based on their severity. We also require that our suppliers and third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards.

Incidents & Risks