Company: BSX
Filing Date: 2025-02-18
Form Type: 10-K
Source: 0000885725-25-000011
Chunk: 75

Company: BOSTON SCIENTIFIC CORP
Filing Date: 2025-02-18
Form: 10-K
Item: Item 1C
Chunk 75
---
ITEM 1C. CYBERSECURITY

Risk Management and StrategyWe rely on information technology (IT) and operational technology (OT) systems, including technology from third party vendors, to manufacture and ship our products, as well as to process, transmit and store electronic information in our day-to-day operations. We have established an enterprise cybersecurity program, which is administered by a cross-functional team of cybersecurity professionals that includes employees and third party contractors and vendors, that utilizes various tools, methodologies and processes to assess, identify and manage cybersecurity risks related to our IT and OT systems, as well as our products. Our cybersecurity program is designed to monitor and continually enhance our enterprise security posture, with the goal of preventing cybersecurity incidents to the extent feasible, including assessments to better understand our readiness for cybersecurity threats and the resilience of our critical business functions, with the goal of avoiding or reducing the impact if such an event were to occur. We have implemented cybersecurity policies mapped to industry and government standards and frameworks, such as U.S. National Institute of Standards and Technology (NIST) and International Standard of Organization, and our strategy is aligned to the NIST CyberSecurity Framework that provides us a structured approach to managing our cybersecurity risk through its five core functions. We regularly review our cybersecurity policies and require annual cybersecurity training for our employees. We also periodically conduct simulation exercises involving employees at various levels of the organization, as well as our Board of Directors, to prepare for cybersecurity incidents and response planning. Our product cybersecurity focus begins with our design protocols and is supported by quality testing, provider education, and packaging and distribution standards. We use penetration testing to simulate cyberattacks and better understand our exploitable weaknesses, and we monitor threat intelligence feeds, including avenues for product users to report vulnerabilities directly to us, and use scanning tools to detect and assess vulnerabilities that could affect our products. In addition, we conduct product, enterprise and vendor/third party risk assessments, vulnerability assessments and analyses to gain insights into potential vulnerabilities and their impact on critical functions, and leverage their outcomes to prioritize our security investments and balance our resource allocation. We use third party security providers for specialized areas such as incident response, penetration testing, and on-demand cybersecurity services, including staff augmentation and consulting. We also leverage a managed security service provider to augment our cybersecurity organization and to provide additional monitoring and response capabilities. We engage and rely upon third parties to provide services and/or goods, represent and/or otherwise act on our behalf. Prior to engaging or conducting any business with or on our behalf, such parties undergo a due diligence review