Company: BKR
Filing Date: 2025-02-04
Form Type: 10-K
Source: 0001701605-25-000035
Chunk: 112

Company: Baker Hughes Co
Filing Date: 2025-02-04
Form: 10-K
Item: Item 1A
Chunk 112
---
 and customers' data. We utilize various procedures and controls to monitor and mitigate our exposure including maintaining a dedicated Cyber Fusion Center ("CFC") and engaging third party experts. For more information see the "Risk Management & Strategy" section of Part 1 of Item 1C herein. While we attempt to mitigate these risks, we remain vulnerable to cyber-attacks and other security incidents, including ransomware incidents. Given our global footprint, the large number of customers, partners, suppliers and service providers with which we do business, and the increasing sophistication and complexity of cyber-attacks, an incident could occur and persist for an extended period without detection. Any investigation of a cyber-attack or other security incident would be inherently 

Baker Hughes Company 2024 Form 10-K | 24

unpredictable, and it would take time before the completion of any investigation and the availability of full and reliable information. During such time we would not necessarily know the extent of the harm or how best to remediate it, and certain errors or actions could be repeated or compounded before they are discovered and remediated, all or any of which would further increase the costs and consequences of such an incident. We may be required to expend significant resources to protect against, respond to, and recover from any cyber-attacks and other security incidents. As cyber-attacks continue to evolve, we may be required to expend significant additional resources to continue to modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. In addition, our remediation efforts may not be successful. The inability to implement, maintain and upgrade adequate safeguards could materially and adversely affect our financial condition, results of operations and cash flows.

In addition to our own systems, we use third-party service providers, who in turn may also use third-party providers, to process certain data or information on our behalf. Due to applicable laws and regulations or contractual obligations, we may be held responsible for cybersecurity incidents attributed to our service providers or other third parties to the extent affecting information we share with them. Although we contractually require these third parties to implement and maintain reasonable security measures, we cannot control third parties and cannot guarantee that a security breach will not occur in their systems.

Our digital technologies and services, as well as third-party products, services and technologies on which we rely (including emerging technologies, such as artificial intelligence programs), are subject to the risk of cyberattacks. Despite our and our service providers' efforts to protect our data and information, there can be no assurance that the systems we have