Company: BSX
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000885725-25-000011
Chunk: 76

Company: BOSTON SCIENTIFIC CORP
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1C
Chunk 76
---
, and a third party security risk assessment is conducted to validate they are legally permitted and qualified to maintain appropriate safeguards to protect our information assets in connection with the services they intend to provide. We perform supplemental reviews as necessary commensurate with the risk associated with each third party, for example, if or when a third party is affected by an incident, that directly or indirectly impacts our company we undertake a full assessment and implement additional controls commensurate to the risk. Furthermore, to minimize risks and vulnerabilities to our systems, our cybersecurity team continuously monitors and addresses cybersecurity threats and incidents at third-party service providers.Assessing, identifying, and managing cybersecurity related risks are also integrated into our enterprise risk management (ERM) program. Cybersecurity related risks are included in the risk universe that the ERM function evaluates to assess top risks to the Company on an annual basis. Risks are discussed with appropriate members of management, who manage risk coverage, monitoring and reporting in the relevant risk function, including our cybersecurity program, and incorporate those activities as part of developing our strategic plan. The ERM program’s annual risk assessment is presented annually to our Board of Directors.Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us. For additional information, see Item 1A. “Risk Factors” for a discussion of cybersecurity risks that we face.

32

GovernanceOur global cybersecurity organization is led by our chief information security officer (CISO), who reports directly to our chief information officer (CIO) and under the organization of our chief information and digital officer (CIDO). Our current CISO has over 19 years of extensive information technology experience, including in security architecture, software development and engineering, as well as leading security operations and incident response, offensive and defensive cyber projects in increasing roles of responsibility. He also previously held Certified Information Systems Security Professional (CISSP) and GIAC Certified Forensics Analyst certifications. Our current CIDO has extensive experience overseeing information technology and security programs, including roles of increasing leadership within our Information and Digital organizations over the last ten years, and prior to that in