Company: GEHC
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0001932393-25-000005
Chunk: 72

Company: GE HealthCare Technologies Inc.
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 72
---
ITEM 1C. CYBERSECURITY

CYBERSECURITY RISK MANAGEMENT.GE HealthCare employs practices, processes, and procedures to proactively and comprehensively manage risks, including risks related to cybersecurity, through its enterprise risk management (“ERM”) program. We aim to identify material cybersecurity risks via multiple strategies, including user and external reporting, audit and assessment activities, and technology programs. We utilize risk identification and risk mitigation strategies.•Risk identification begins with understanding the devices and equipment in use across the company, including laptops and other data devices, industrial equipment and machinery, and associated risks related to the use of those devices and equipment.•Risk mitigation entails protecting our data and operational systems via a system of controls. We monitor and collect data about the devices and users that touch our network resources, reviewing this data for anomalies. When we identify anomalies, we investigate to determine if the anomaly represents a threat. We have a process to contain and remediate identified threats. As discussed further below, we have incident response processes in place to utilize in case of threats or incidents. We conduct regular crisis simulations.Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our ERM assessment program as well as our cybersecurity-specific risk identification program, as discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data, or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. We have a dedicated team of cyber professionals who report to our Chief Information Security Officer (“CISO”). This team publishes information technology and security policies, measures compliance, and operates a program to mitigate risks and threats. Our risk mitigation activities include network segmentation, cyber protection and containment, detection and reaction, and recovery. This team operates to decrease the risk of cyber incidents having a material impact. We measure our programs against the National Institute of Standards and Technology Cyber Security Framework and regularly test our controls and incident response plans.We maintain incident response plans that guide our activities in preparing for, detecting, responding to, and recovering from cybersecurity incidents. These plans cover the range of activities we undertake in connection with responding to cybersecurity incidents, including assessment, investigation, containment, remediation, and mitigation, as well as compliance with legal obligations including any necessary regulatory reporting. As part of these processes, we regularly engage with assessors