Company: BLCO
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001860742-25-000004
Chunk: 422

Company: Bausch & Lomb Corp
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 422
---
Item 1C.  Cybersecurity

Risk Management and Strategy

Cybersecurity risk management is an integral part of our overall enterprise risk management program. In order to assess, identify, manage and address the risk of cybersecurity threats or incidents, the Company has established a Cybersecurity Risk Management Program, which uses a risk-based approach to implement multi-layered controls designed to enable the Company to maintain agility while protecting critical infrastructure and data. This program, which is an integral part of our overall enterprise risk management program, implements controls and frameworks designed to align with industry best practices, including those based on the National Institute of Standards and Technology Cybersecurity Framework, the Sarbanes-Oxley Act of 2002 and HIPAA.The Cybersecurity Risk Management Program is designed to identify potential vulnerabilities and threats and develop strategies to mitigate and remediate them. To assess, identify, manage, address and minimize the effects of a cybersecurity threat or incident, or a series of related cybersecurity threats or incidents, the Company undertakes a range of activities, including monitoring of its systems and networks, incident response planning, and employee training. The Company also has business continuity and disaster recovery plans in place in the event of a cybersecurity incident, which are regularly reviewed and updated as needed. The Company also regularly engages third-party assessors, consultants, auditors, and other experts to help identify, assess and address potential threats or incidents. The Cybersecurity and Risk Management Team, as described below, is responsible for the operationalization of the Company's cybersecurity practices, which consists of, but are not limited to: (i) updating and enhancing the Cybersecurity Risk Management Program, (ii) overseeing third-party assessors, consultants, auditors, and other experts, and (iii) assessing, identifying, managing and addressing potential threats or incidents.