Company: DHR
Filing Date: 2025-03-26
Form Type: ARS
Source: 0000313616-25-000085
Chunk: 64

Company: DANAHER CORP /DE/
Filing Date: 2025-03-26
Form: ARS
Chunk 64
---
 impact on our business and financial statements. ITEM 1B. UNRESOLVED STAFF COMMENTS Not applicable. ITEM 1C. CYBERSECURITY Cybersecurity Strategy and Risk Management Danaher’s cybersecurity strategy and risk management program focuses on seeking to maintain a secure environment for our data that complies with applicable legal requirements and effectively supports our business objectives and customer needs. Our commitment to cybersecurity emphasizes cultivation of a security-minded culture through education and training, and a programmatic and layered approach to prevention and detection of, and response to, cybersecurity threats. Key elements of our program for identifying, assessing and managing material risks from cybersecurity threats are described below. We maintain cybersecurity policies that articulate Danaher’s expectations and requirements with respect to topics such as acceptable use of technology and data, data privacy, risk management, education and awareness and event and incident management. We regularly conduct exercises, with the support of outside domain experts, to improve the effectiveness of our processes and we periodically assess our processes against recognized cybersecurity frameworks. Consistent with our position that cybersecurity is the responsibility of every Danaher associate, we regularly educate and share best practices with our associates to raise awareness of cybersecurity threats. Every year, associates in applicable job categories are required to take information security and protection training as part of the Danaher Annual Training Program. We also conduct regular education and training for our associates through cyber-event simulations. We strive to implement and maintain layered controls designed to prevent and, where necessary, detect and respond to cybersecurity threats. Our physical controls are designed to restrict access to locations that house significant physical information technology assets. Our technical preventive controls include access restrictions and network security technologies. Our notification policies and processes are designed to have notifications and alerts escalated to the appropriate personnel on a timely basis to support effective review, response and compliance with legal requirements. In addition to event-specific notifications, data is aggregated and compiled on a regular basis to support the identification of trends and effective program review and oversight. We also recognize that Danaher is exposed to cybersecurity risks that affect third parties whom we rely on to process, store or transmit our electronic information. To manage these risks, we maintain technical security controls as well as processes designed to facilitate Danaher’s identification of third-party cybersecurity risks. 31

Key elements of Danaher’s annual Enterprise Risk Management (“ERM”) program include an inventory and classification of key risk areas and topics; a methodology for scoring risks based on the risk’s probability, severity and velocity of impact, and for trending key risks; and a framework for