Company: THC
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000070318-25-000009
Chunk: 212

Company: TENET HEALTHCARE CORP
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1C
Chunk 212
---
ITEM 1C. CYBERSECURITY

RISK MANAGEMENT AND STRATEGY

We identify and assess areas of risk for our company on an ongoing basis, and we have developed, and regularly refine, comprehensive practices to manage and mitigate existing and potential risks to our business. Our board of directors oversees enterprise risk management as an integral and continuous part of its oversight role. Integrated into our overall enterprise risk management framework are processes dedicated to the identification, assessment and management of material risks from cybersecurity threats. Our approach to cybersecurity risk management is both proactive and defensive, and includes the following elements:•a team dedicated solely to cybersecurity and managed by our chief information security officer (“CISO”), who reports directly to our chief information officer (“CIO”);•an information technology request review process that includes cybersecurity assessments of third-party products and systems proposed to connect to our information systems environment or access our data; and•a cybersecurity incident response plan.Cybersecurity Team and Strategy—Our cybersecurity team, which includes both our employees and those of our managed services provider, is comprised of subgroups focused on distinct functional areas of responsibility. The team maintains a Security Operations Center, staffed 24 hours a day, that delivers day-to-day execution support for our cybersecurity risk management program.We leverage a multi-layered strategy that is designed to assess, identify, manage and mitigate risks to our systems and data from cybersecurity threats. Proactively, we have implemented numerous threat‑management tools and processes. In addition, we have disaster recovery and business continuity plans that are tested and updated periodically. We strive to stay abreast of cybersecurity threats through integrated threat intelligence feeds, industry and federal threat notices, and participation in healthcare industry intelligence sharing. Our program leverages best practices and is guided by industry frameworks, including the National Institute of Standards and Technology Cyber Security Framework. We also conduct table-top exercises, which serve to simulate cybersecurity incidents to practice response and identify gaps, on a regular basis. Our internal audit team performs random sampling audits of security practices at our facilities, and we routinely perform security risk assessments.We also require all employees to participate in cybersecurity awareness training annually, and we circulate cybersecurity awareness alerts, safety tips and newsletters to employees across the enterprise regularly. In addition, we routinely run phishing campaigns and perform other tests to increase awareness of cybersecurity threats.Third-Party Review Processes—Our business requires interaction of our systems and the sharing of data with third parties, including our service providers and vendors, as well as other healthcare providers and their vendors, that present risks to our systems and data