XML 52 R33.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We assess, identify and manage risks from cybersecurity threats through our Global Cybersecurity and Compliance Program (Cybersecurity Program). Cybersecurity risks identified in the Cybersecurity Program are integrated into our Enterprise Risk Management Program. In addition, the Cybersecurity Program seeks to incorporate consideration of cybersecurity risk into our product development, business strategy, financial planning and capital allocation decisions.
The Cybersecurity Program is currently overseen by the Board of Directors (Board) and is managed by a dedicated Chief Information Security Officer (CISO), who in turn reports to the Chief Information Officer (CIO), who currently reports to the CEO. The CISO's organization has oversight responsibilities for cybersecurity strategy, policy, standards, architecture and processes for the security of our corporate and manufacturing enterprise network, information assets and medical device technologies. Our current CISO has over 20 years of experience in cybersecurity and risk and technology management, and has held numerous positions in the cybersecurity sector, including serving as Global Cyber Risk Officer at another Fortune 500 medical products and equipment company and CISO at other healthcare companies and health care delivery organizations. Our current CIO has over 30 years of experience in information technology and has served in a number of professional services leadership roles, including as CIO over the past 15 years at three companies. The CISO’s organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated as necessary to align with the changing threat landscape, our evolving business needs as well as global regulatory requirements. In addition, from time to time, we also utilize external auditors and assessors to help evaluate our Cybersecurity Program, including conducting penetration testing and vulnerability, risk and maturity assessments. We also actively engage with industry experts, regulatory agencies, advocacy groups, industry peers, intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our Cybersecurity Program and to stay abreast of the emerging cybersecurity landscape.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Cybersecurity risks identified in the Cybersecurity Program are integrated into our Enterprise Risk Management Program. In addition, the Cybersecurity Program seeks to incorporate consideration of cybersecurity risk into our product development, business strategy, financial planning and capital allocation decisions.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block] Program are integrated into our Enterprise Risk Management Program. In addition, the Cybersecurity Program seeks to incorporate consideration of cybersecurity risk into our product development, business strategy, financial planning and capital allocation decisions. The Cybersecurity Program is currently overseen by the Board of Directors (Board) and is managed by a dedicated Chief Information Security Officer (CISO), who in turn reports to the Chief Information Officer (CIO), who currently reports to the CEO. The CISO's organization has oversight responsibilities for cybersecurity strategy, policy, standards, architecture and processes for the security of our corporate and manufacturing enterprise network, information assets and medical device technologies.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] In February 2024, we amended the charters of the Audit Committee and Quality and Regulatory Compliance (QRC) Committee of our Board to provide for the realignment of oversight over the company’s innovation strategy and cybersecurity to the full Board, as these responsibilities now sit within the vertically integrated segments and are part of the business strategies themselves. The Board oversees information technology functions generally, including product related cybersecurity matters (which had previously been subject to the oversight of the QRC Committee). The Audit Committee is responsible for the oversight of certain significant cybersecurity incidents, including ones related to our products and services and receives related updates from management on those incidents
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
The Cybersecurity Program maintains a cybersecurity governance and oversight framework that seeks to drive accountability for all levels of employees, including senior management and executive officers. Cybersecurity matters are generally managed by a combination of working groups that report to the cybersecurity compliance committee and ultimately the cybersecurity executive oversight committee, as appropriate. Our cross functional cybersecurity compliance committee, which is led by the CISO, is composed of members of senior management, including the CIO, and reviews matters such as cybersecurity escalations, critical remediations and disclosure recommendations. The output from the cybersecurity compliance committee meetings is discussed at meetings of Baxter’s cybersecurity executive oversight committee, which is led by the CISO and includes the CIO and other members of management.
In February 2024, we amended the charters of the Audit Committee and Quality and Regulatory Compliance (QRC) Committee of our Board to provide for the realignment of oversight over the company’s innovation strategy and cybersecurity to the full Board, as these responsibilities now sit within the vertically integrated segments and are part of the business strategies themselves. The Board oversees information technology functions generally, including product related cybersecurity matters (which had previously been subject to the oversight of the QRC Committee). The Audit Committee is responsible for the oversight of certain significant cybersecurity incidents, including ones related to our products and services and receives related updates from management on those incidents. Consistent with this oversight responsibility, the Audit Committee is responsible for reviewing proposed disclosures in connection with any material cybersecurity incident consistent with our disclosure obligations under Item 1.05 of Form 8-K. The full Board receives periodic updates on information technology and cybersecurity matters from company management (including the CIO and CISO) and external advisors from time to time and the Audit Committee receives periodic updates (including as part of continuing director education) on the evolving cybersecurity landscape and regulatory reporting requirements.
The CISO maintains and annually updates a Cybersecurity Incident Response Plan which is a guide for our Cyber Security Incident Response Team and business to respond to cybersecurity incidents in a coordinated manner. Additionally, the CISO, in partnership with a third-party consultant, facilitates periodic cyber-crisis tabletop exercises with members of senior management (including our executive officers) to help us prepare for the occurrence of a significant cybersecurity event and our related response activities. Cybersecurity risks and threats, including any previous cybersecurity incidents, have not materially impacted us or our operations to date. However, we cannot provide any assurance that we will not be subject to a material cybersecurity incident in the future. See "Risks Relating to Our Operations—Breaches and breakdowns affecting our information technology systems or protected information, including from cyber security breaches and data leakage, could have a material adverse effect on our business, results of operations, financial condition, cash flows, reputation and competitive position” in Item 1A. Risk Factors of this Annual Report on Form 10-K for a discussion of cybersecurity-related risks.
Cybersecurity Risk Role of Management [Text Block]
The Cybersecurity Program maintains a cybersecurity governance and oversight framework that seeks to drive accountability for all levels of employees, including senior management and executive officers. Cybersecurity matters are generally managed by a combination of working groups that report to the cybersecurity compliance committee and ultimately the cybersecurity executive oversight committee, as appropriate. Our cross functional cybersecurity compliance committee, which is led by the CISO, is composed of members of senior management, including the CIO, and reviews matters such as cybersecurity escalations, critical remediations and disclosure recommendations. The output from the cybersecurity compliance committee meetings is discussed at meetings of Baxter’s cybersecurity executive oversight committee, which is led by the CISO and includes the CIO and other members of management.
In February 2024, we amended the charters of the Audit Committee and Quality and Regulatory Compliance (QRC) Committee of our Board to provide for the realignment of oversight over the company’s innovation strategy and cybersecurity to the full Board, as these responsibilities now sit within the vertically integrated segments and are part of the business strategies themselves. The Board oversees information technology functions generally, including product related cybersecurity matters (which had previously been subject to the oversight of the QRC Committee). The Audit Committee is responsible for the oversight of certain significant cybersecurity incidents, including ones related to our products and services and receives related updates from management on those incidents. Consistent with this oversight responsibility, the Audit Committee is responsible for reviewing proposed disclosures in connection with any material cybersecurity incident consistent with our disclosure obligations under Item 1.05 of Form 8-K. The full Board receives periodic updates on information technology and cybersecurity matters from company management (including the CIO and CISO) and external advisors from time to time and the Audit Committee receives periodic updates (including as part of continuing director education) on the evolving cybersecurity landscape and regulatory reporting requirements.
The CISO maintains and annually updates a Cybersecurity Incident Response Plan which is a guide for our Cyber Security Incident Response Team and business to respond to cybersecurity incidents in a coordinated manner. Additionally, the CISO, in partnership with a third-party consultant, facilitates periodic cyber-crisis tabletop exercises with members of senior management (including our executive officers) to help us prepare for the occurrence of a significant cybersecurity event and our related response activities. Cybersecurity risks and threats, including any previous cybersecurity incidents, have not materially impacted us or our operations to date. However, we cannot provide any assurance that we will not be subject to a material cybersecurity incident in the future. See "Risks Relating to Our Operations—Breaches and breakdowns affecting our information technology systems or protected information, including from cyber security breaches and data leakage, could have a material adverse effect on our business, results of operations, financial condition, cash flows, reputation and competitive position” in Item 1A. Risk Factors of this Annual Report on Form 10-K for a discussion of cybersecurity-related risks.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] In February 2024, we amended the charters of the Audit Committee and Quality and Regulatory Compliance (QRC) Committee of our Board to provide for the realignment of oversight over the company’s innovation strategy and cybersecurity to the full Board, as these responsibilities now sit within the vertically integrated segments and are part of the business strategies themselves. The Board oversees information technology functions generally, including product related cybersecurity matters (which had previously been subject to the oversight of the QRC Committee). The Audit Committee is responsible for the oversight of certain significant cybersecurity incidents, including ones related to our products and services and receives related updates from management on those incidents
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our current CISO has over 20 years of experience in cybersecurity and risk and technology management, and has held numerous positions in the cybersecurity sector, including serving as Global Cyber Risk Officer at another Fortune 500 medical products and equipment company and CISO at other healthcare companies and health care delivery organizations. Our current CIO has over 30 years of experience in information technology and has served in a number of professional services leadership roles, including as CIO over the past 15 years at three companies.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
The Cybersecurity Program maintains a cybersecurity governance and oversight framework that seeks to drive accountability for all levels of employees, including senior management and executive officers. Cybersecurity matters are generally managed by a combination of working groups that report to the cybersecurity compliance committee and ultimately the cybersecurity executive oversight committee, as appropriate. Our cross functional cybersecurity compliance committee, which is led by the CISO, is composed of members of senior management, including the CIO, and reviews matters such as cybersecurity escalations, critical remediations and disclosure recommendations. The output from the cybersecurity compliance committee meetings is discussed at meetings of Baxter’s cybersecurity executive oversight committee, which is led by the CISO and includes the CIO and other members of management.
In February 2024, we amended the charters of the Audit Committee and Quality and Regulatory Compliance (QRC) Committee of our Board to provide for the realignment of oversight over the company’s innovation strategy and cybersecurity to the full Board, as these responsibilities now sit within the vertically integrated segments and are part of the business strategies themselves. The Board oversees information technology functions generally, including product related cybersecurity matters (which had previously been subject to the oversight of the QRC Committee). The Audit Committee is responsible for the oversight of certain significant cybersecurity incidents, including ones related to our products and services and receives related updates from management on those incidents. Consistent with this oversight responsibility, the Audit Committee is responsible for reviewing proposed disclosures in connection with any material cybersecurity incident consistent with our disclosure obligations under Item 1.05 of Form 8-K. The full Board receives periodic updates on information technology and cybersecurity matters from company management (including the CIO and CISO) and external advisors from time to time and the Audit Committee receives periodic updates (including as part of continuing director education) on the evolving cybersecurity landscape and regulatory reporting requirements.
The CISO maintains and annually updates a Cybersecurity Incident Response Plan which is a guide for our Cyber Security Incident Response Team and business to respond to cybersecurity incidents in a coordinated manner. Additionally, the CISO, in partnership with a third-party consultant, facilitates periodic cyber-crisis tabletop exercises with members of senior management (including our executive officers) to help us prepare for the occurrence of a significant cybersecurity event and our related response activities. Cybersecurity risks and threats, including any previous cybersecurity incidents, have not materially impacted us or our operations to date. However, we cannot provide any assurance that we will not be subject to a material cybersecurity incident in the future. See "Risks Relating to Our Operations—Breaches and breakdowns affecting our information technology systems or protected information, including from cyber security breaches and data leakage, could have a material adverse effect on our business, results of operations, financial condition, cash flows, reputation and competitive position” in Item 1A. Risk Factors of this Annual Report on Form 10-K for a discussion of cybersecurity-related risks.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true