3M CO

Previous wording

During the second quarter of 2024, the Company derived approximately 55 percent of its revenues from outside the United States. Accordingly, the Company’s operations and the execution of its business strategies and plans are subject to global competition and economic and geopolitical risks that are beyond its control, such as, among other things, disruptions in financial markets, economic downturns, military conflicts, terrorism, public health emergencies, political changes and trends such as protectionism, economic nationalism resulting in government actions impacting international trade agreements or imposing trade restrictions such as tariffs and retaliatory counter measures, and government deficit reduction and other austerity measures in locations or industries in which the Company operates. Further escalation of specific trade tensions, including those between the U.S. and China, or more broadly in global trade conflict, could adversely impact the Company's business and operations around the world. The Company's business is also impacted by social, political, and labor conditions in locations in which the Company or its suppliers or customers operate; adverse changes in the availability and cost of capital; monetary policy; interest rates; inflation; recession; commodity prices; currency volatility or exchange control; ability to expatriate earnings; and other laws and regulations in the jurisdictions in which the Company or its suppliers or customers operate. For example, changes in local economic condition or outlooks, such as lower economic growth rates in China, Europe, or other key markets, impact the demand or profitability of the Company's products.

Current wording

During the third quarter of 2024, the Company derived approximately 55 percent of its revenues from outside the United States. Accordingly, the Company’s operations and the execution of its business strategies and plans are subject to global competition and economic and geopolitical risks that are beyond its control, such as, among other things, disruptions in financial markets, economic downturns, military conflicts, terrorism, public health emergencies, political changes and trends such as protectionism, economic nationalism resulting in government actions impacting international trade agreements or imposing trade restrictions such as tariffs and retaliatory counter measures, and government deficit reduction and other austerity measures in locations or industries in which the Company operates. Further escalation of specific trade tensions, including those between the U.S. and China, or more broadly in global trade conflict, could adversely impact the Company's business and operations around the world. The Company's business is also impacted by social, political, and labor conditions in locations in which the Company or its suppliers or customers operate; adverse changes in the availability and cost of capital; monetary policy; interest rates; inflation; recession; commodity prices; currency volatility or exchange control; ability to expatriate earnings; and other laws and regulations in the jurisdictions in which the Company or its suppliers or customers operate. For example, changes in local economic condition or outlooks, such as lower economic growth rates in China, Europe, or other key markets, impact the demand or profitability of the Company's products.

Previous wording

The Company operates globally, including in some jurisdictions that pose potentially elevated risks of fraud or corruption or increased risk of internal control issues, and is subject to risks related to international, federal, state, and local treaties, laws, and regulations, including those involving product liability; securities and corporate laws; antitrust and competition laws; intellectual property; environmental, health, and safety; tax; the U.S. Foreign Corrupt Practices Act (FCPA) and other anti-bribery, anti-corruption laws; international import and export requirements and trade sanctions compliance; laws and regulations that apply to industries served by the Company, including the False Claims Act, anti-kickback laws, and the Sunshine Act; and other matters. The Company is also subject to compliance risks related to legal or regulatory requirements, contract requirements, policies and practices, or other matters that require or encourage the Company and its suppliers, vendors, or channel parties, to conduct business in a certain way. Legal compliance risks also include third-party risks where the Company’s suppliers, vendors, or channel partners, or trade associations to which the Company belongs, have business practices that are inconsistent with 3M’s Supplier Responsibility Code, 3M performance requirements, or with legal requirements.

Current wording

The Company operates globally, including in some jurisdictions that pose potentially elevated risks of fraud or corruption or increased risk of internal control issues, and is subject to risks related to international, federal, state, and local treaties, laws, and regulations, including those involving product liability; securities and corporate laws; antitrust and competition laws; intellectual property; environmental, health, and safety; tax; the U.S. Foreign Corrupt Practices Act (FCPA) and other anti-bribery and anti-corruption laws; international import and export requirements and trade sanctions compliance; laws and regulations that apply to industries served by the Company, including the False Claims Act, anti-kickback laws, and the Sunshine Act; and other matters. The Company is also subject to compliance risks related to legal or regulatory requirements, contract requirements, policies and practices, or other matters that require or encourage the Company and its suppliers, vendors, or channel parties, to conduct business in a certain way. Legal compliance risks also include third-party risks where the Company’s suppliers, vendors, or channel partners, or trade associations to which the Company belongs, have business practices that are inconsistent with 3M’s Supplier Responsibility Code, 3M performance requirements, or with legal requirements.

Previous wording

The Company employs information including operational technology systems to support its business and to collect, store, and/or use proprietary and confidential information, including ongoing phased implementation of an enterprise resource planning (ERP) system as part of its business transformation on a worldwide basis over the next several years. Security and data breaches, cyberattacks, and other cybersecurity incidents involving the Company’s information technology systems, networks and infrastructure could disrupt or interfere with the Company’s operations; result in the compromise and misappropriation of proprietary and confidential information belonging to the Company or its customers, suppliers, and employees; and expose the Company to numerous expenses, liabilities, and other negative consequences, any or all of which could adversely impact the Company’s business, reputation, and results of operations.

Current wording

The Company employs information including operational technology systems to support its business and to collect, store, and/or use proprietary and confidential information, including ongoing phased implementation of an enterprise resource planning (ERP) system as part of its business transformation on a worldwide basis over the next several years. Network disruptions, security and data breaches, cyberattacks, and other cybersecurity incidents involving the Company’s information technology systems, networks and infrastructure could disrupt or interfere with the Company’s operations; result in the compromise and misappropriation of proprietary and confidential information belonging to the Company or its customers, suppliers, and employees; and expose the Company to numerous expenses, liabilities, and other negative consequences, any or all of which could adversely impact the Company’s business, reputation, and results of operations.

Previous wording

In the ordinary course of business, the Company relies on centralized and local information technology networks and systems, some of which are provided, hosted, or managed by vendors and other third parties, to process, transmit, and store electronic information, and to manage or support a variety of businesses. Additionally, the Company collects and stores certain data, including proprietary business information, and has access to confidential or personal information in certain of our businesses that is subject to privacy and cybersecurity laws, regulations, and customer-imposed controls. Third parties and threat actors, including organized criminals, nation-state entities, and/or nation-state supported actors, regularly attempt to gain unauthorized access to the Company’s information and operational technology networks and infrastructure, data, and other information, and many such attempts are becoming increasingly sophisticated. Despite our cybersecurity and business continuity counter measures (including employee and third-party training, monitoring of networks and systems, patching, maintenance, and backup of systems and data), the Company’s information and operational technology systems, networks and infrastructure have experienced and are expected to experience cyberattacks of various degrees of sophistication, and are susceptible to insider threat, compromise, damage, disruption, or shutdown, including as a result of the exploitation of known or unknown hardware or software vulnerabilities, or zero day attacks, in our systems or the systems of our vendors and third-party service providers, the introduction of computer viruses, malware or ransomware, service or cloud provider disruptions or security breaches, phishing attempts, employee error or malfeasance, power outages, telecommunication or utility failures, systems failures, natural disasters, or other catastrophic events. The Company’s increased adoption of remote working, initially driven by the COVID-19 health pandemic, also introduces additional threats and risk of disruptions to our information technology systems, networks and infrastructure. Despite our cybersecurity counter measures, it is possible for security vulnerabilities or a cyberattack to remain undetected for an extended time period, up to and including several months, and the prioritization of decisions with respect to security measures and remediation of known vulnerabilities that we and the vendors and other third parties upon which we rely make may prove inadequate to protect against these attacks. While we and third parties we utilize have experienced, and expect to continue to experience, cybersecurity incidents that could lead to other disruptions of the Company’s and the third parties' information and operational technology systems and infrastructure, we do not believe that any such cybersecurity incidents to date have had a material impact on the Company. Any cybersecurity incident or information or operational…

Excerpt shortened here; the source contains the full paragraph.

Current wording

In the ordinary course of business, the Company relies on centralized and local information technology networks and systems, some of which are provided, hosted, or managed by vendors and other third parties, to process, transmit, and store electronic information, and to manage or support a variety of businesses. Additionally, the Company collects and stores certain data, including proprietary business information, and has access to confidential or personal information in certain of our businesses that is subject to artificial intelligence, privacy and cybersecurity laws, regulations, and customer-imposed controls. Third parties and threat actors, including organized criminals, nation-state entities, and/or nation-state supported actors, regularly attempt to gain unauthorized access to the Company’s information and operational technology networks and infrastructure, data, and other information, and many such attempts are becoming increasingly sophisticated. Despite our cybersecurity and business continuity counter measures (including employee and third-party training, monitoring of networks and systems, patching, maintenance, and backup of systems and data), the Company’s information and operational technology systems, networks and infrastructure have experienced and are expected to experience cyberattacks of various degrees of sophistication, and are susceptible to insider threat, compromise, damage, disruption, or shutdown, including as a result of the exploitation of known or unknown hardware or software vulnerabilities, or zero day attacks, in our systems or the systems of our vendors and third-party service providers, the introduction of computer viruses, malware or ransomware, service or cloud provider disruptions or security breaches, phishing attempts, employee error or malfeasance, power outages, telecommunication or utility failures, systems failures, natural disasters, or other catastrophic events. The Company’s increased adoption of remote working, initially driven by the COVID-19 health pandemic, also introduces additional threats and risk of disruptions to our information technology systems, networks and infrastructure. Despite our cybersecurity counter measures, it is possible for security vulnerabilities or a cyberattack to remain undetected for an extended time, up to and including several months, and the prioritization of decisions with respect to security measures and remediation of known vulnerabilities that we and the vendors and other third parties upon which we rely make may prove inadequate to protect against these attacks. While we and third parties we utilize have experienced, and expect to continue to experience, cybersecurity incidents that could lead to other disruptions of the Company’s and the third parties' information and operational technology systems and infrastructure, we do not believe that any such cybersecurity incidents to date have had a material impact on the Company. Any cybersecurity incident or informat…

Excerpt shortened here; the source contains the full paragraph.