Company: BLCO
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001860742-25-000004
Chunk: 252

Company: Bausch & Lomb Corp
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1A
Chunk 252
---
 parties. Additionally, any contractual protections with such third parties, including the Company’s right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on its business from any such compromise or failure.Impact of cybersecurity risks on business strategy, results of operations or financial conditionDespite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see “Risk Factors—Risks Relating to Information Technology—We have become increasingly dependent on information technology systems and infrastructure and any breakdown, interruption, breach or other compromise of our information technology systems or those of our third party service providers could subject us to liability or interrupt the operation of our business, which could have a material adverse effect on our business, financial condition, cash flows and results of operations and could cause the market value of our common shares to decline” under Item 1A of this Annual Report on Form 10-K.GovernanceBecause cybersecurity and data privacy can affect all facets of the Company's business, the Company employs governance structures that facilitate cross-functional, proactive risk management. The Board is responsible for oversight of the Company’s risks from cybersecurity threats and incidents and the Audit Committee maintains primary responsibility related to monitoring this oversight. As noted above, the Company has in place the following teams who are responsible for maintaining various phases of the Cybersecurity Risk Management Program:•Cybersecurity and Risk Management Team which is led by the VP, IT Security and Risk Management, who reports directly to the interim Chief Information Officer (“CIO”). The Cybersecurity and Risk Management Team is overseen by: (i) the Executive Committee, which consists of, among others, the Chief Executive Officer, Chief Financial Officer, Chief Legal Officer and Chief Compliance and Privacy Officer, and (ii) the Audit Committee. The 

54

Cybersecurity and Risk Management Team is responsible for maintaining and carrying out the Cybersecurity Risk Management Program.•Materiality Committee, which is led by the interim CIO, Controller and Chief Accounting Officer, and SVP, Assistant General Counsel. The Cybersecurity and Risk Management Team informs the Materiality Committee of Severity 1 incidents and the Materiality Committee is then responsible for assessing whether a threat or an incident has materially affected or is likely to materially affect the Company’s business strategy, results of operations or financial condition. Once it is determined that a matter has had a material impact or it is reasonably likely to have a material impact on the Company, the