Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
---|---|
Mar. 31, 2025 | |
Cybersecurity Risk Management, Strategy, and Governance [Line Items] | |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Risk management and strategy Cybersecurity Risk Management Framework Takeda maintains a cybersecurity controls framework designed to identify, protect from, detect, respond to and recover from cybersecurity threats consistent with the U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) Cybersecurity Framework. Preventive control measures are deployed across Takeda’s application, cloud, end-user device, networking and manufacturing infrastructure. Takeda’s Chief Information Security Officer (“CISO”) oversees our cybersecurity risk management framework, reporting to the Chief Data and Technology Officer (“CDTO”). Our CISO has over 30 years of experience in information technology, including more than 10 years serving in a CISO capacity at companies in various industries, including pharmaceuticals. Experienced and trained cyber risk professionals in the Cybersecurity & Risk team (“TCR”) within Takeda’s global data, digital & technology function (“DD&T”), many of whom hold certifications from established cybersecurity organizations, are responsible for identifying and managing cybersecurity risks from various sources, including proactive control evaluations, reporting by Takeda personnel, third-party security assessments, penetration testing, threat modeling, and vulnerability scanning of information systems. Takeda’s internal audit function performs periodic assessments on our cybersecurity controls framework. Third-party security assessments are performed during the vendor selection process or when significant changes are made to a vendor relationship, with each vendor assigned a residual risk rating which determines the frequency of re-assessment. Our commercial agreements typically include contractual provisions to ensure third-party vendors meet Takeda’s standards for data protection. TCR risk professionals assess identified risks for their perceived severity of impact on Takeda and likelihood of occurrence, and design and implement appropriate responsive measures in collaboration with relevant business units. TCR provides to the CISO on a monthly basis, and to other members of DD&T senior management on a quarterly basis, operational reports regarding the number and nature of cyber incidents detected and the status of controls and program enhancements. Cybersecurity risk management is integrated into Takeda’s Enterprise Risk Management (“ERM”) program and addressed as a principal risk in our annual Enterprise Risk Assessment, which is reported to the RECC and the Board of Directors, each of which is responsible for approving the reported risks and associated mitigation plans, as well as assessing the effectiveness of the mitigation. In addition, all Takeda employees receive online training on cyber threats as well as periodic e-mail reminders about best practices to safeguard from those threats. While Takeda’s cybersecurity risk management program is principally directed by TCR risk professionals, during the fiscal year ended March 31, 2025, Takeda initiated a multi-year program to invest further in its cybersecurity capabilities in part through the retention of a third-party managed security service provider (MSSP). The MSSP is responsible for facilitating cybersecurity operations, incident response and access management activities involving Takeda personnel and other third parties in a centralized and coordinated manner to enhance the effectiveness and efficiency of Takeda’s cybersecurity program. TCR risk professionals oversee the MSSP and remain principally responsible for cybersecurity risk management. Takeda also engages with other third parties for its cybersecurity program on an as-needed basis, including with respect to technical consulting and third-party digital forensic or cyber recovery partners in connection with incident response activities. Cybersecurity Incident Response The TCR team has established an incident response procedure that governs our response to cybersecurity events and regularly conducts tabletop incident response exercises during the year. In the event a potential cybersecurity incident is detected, TCR’s core Cybersecurity Incident Response Team (“CIRT”) is responsible with the support of Takeda’s MSSP, for investigation, analysis, containment and eradication of the threat, as well as recovery efforts, in coordination with other functions, such as Takeda’s Privacy Office, Human Resources, Crisis Management, Compliance and Legal, as needed depending on the severity and scope of the incident. Following recovery from an incident, CIRT analyzes the underlying cause of the incident to identify and, as applicable, implement potential improvements to internal controls.
|
Cybersecurity Risk Management Processes Integrated [Flag] | true |
Cybersecurity Risk Management Processes Integrated [Text Block] | Takeda maintains a cybersecurity controls framework designed to identify, protect from, detect, respond to and recover from cybersecurity threats consistent with the U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) Cybersecurity Framework. Preventive control measures are deployed across Takeda’s application, cloud, end-user device, networking and manufacturing infrastructure. Takeda’s Chief Information Security Officer (“CISO”) oversees our cybersecurity risk management framework, reporting to the Chief Data and Technology Officer (“CDTO”). Our CISO has over 30 years of experience in information technology, including more than 10 years serving in a CISO capacity at companies in various industries, including pharmaceuticals. Experienced and trained cyber risk professionals in the Cybersecurity & Risk team (“TCR”) within Takeda’s global data, digital & technology function (“DD&T”), many of whom hold certifications from established cybersecurity organizations, are responsible for identifying and managing cybersecurity risks from various sources, including proactive control evaluations, reporting by Takeda personnel, third-party security assessments, penetration testing, threat modeling, and vulnerability scanning of information systems. Takeda’s internal audit function performs periodic assessments on our cybersecurity controls framework. Third-party security assessments are performed during the vendor selection process or when significant changes are made to a vendor relationship, with each vendor assigned a residual risk rating which determines the frequency of re-assessment. Our commercial agreements typically include contractual provisions to ensure third-party vendors meet Takeda’s standards for data protection. TCR risk professionals assess identified risks for their perceived severity of impact on Takeda and likelihood of occurrence, and design and implement appropriate responsive measures in collaboration with relevant business units. TCR provides to the CISO on a monthly basis, and to other members of DD&T senior management on a quarterly basis, operational reports regarding the number and nature of cyber incidents detected and the status of controls and program enhancements. Cybersecurity risk management is integrated into Takeda’s Enterprise Risk Management (“ERM”) program and addressed as a principal risk in our annual Enterprise Risk Assessment, which is reported to the RECC and the Board of Directors, each of which is responsible for approving the reported risks and associated mitigation plans, as well as assessing the effectiveness of the mitigation. In addition, all Takeda employees receive online training on cyber threats as well as periodic e-mail reminders about best practices to safeguard from those threats.
|
Cybersecurity Risk Management Third Party Engaged [Flag] | true |
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false |
Cybersecurity Risk Board of Directors Oversight [Text Block] | Governance Takeda’s Board of Directors (the “Board”) is ultimately responsible for overseeing Takeda’s management of cybersecurity risk and provides strategic direction for Takeda’s information security program and responses to cybersecurity risks and incidents. Takeda’s CISO generally provides an annual update to the Board on the status of Takeda’s information security program, including significant developments, and the Board receives reports of any decisions by any of Takeda’s Business and Sustainability Committee, Portfolio Review Committee or Risk, Ethics and Compliance Committee (see “Item 6. Directors, Senior Management and Employees—C. Board Practices—Takeda Executive Team”) related to cybersecurity. In addition, the Board reviews and approves the Enterprise Risk Assessment, which includes significant cybersecurity risk matters, on an annual basis. On an as-needed basis, the Board is informed of, and provides strategic direction on, significant cybersecurity risks or incidents, if and when identified, by the CISO and CDTO. The Risk, Ethics & Compliance Committee (“RECC”) is the governing management committee responsible for overseeing risk management, including cybersecurity risk. The RECC is composed of the Takeda Executive Team, including Takeda’s CDTO and is chaired by Takeda’s Chief Ethics and Compliance Officer. In addition, Takeda’s CISO attends RECC meetings for relevant agenda items and generally provides an update to the RECC on the status of Takeda’s information security program, including significant developments, on at least an annual basis. On an as-needed basis, DD&T senior management escalates decisions regarding significant cybersecurity risks to the RECC, which also reviews and approves Takeda’s annual Enterprise Risk Assessment before it is approved by the Board. For a description of the relevant expertise of the CISO and of management’s role and processes in assessing and managing material risks from cybersecurity threats, see “—Risk management and strategy—Cybersecurity Risk Management Framework.”
|
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Takeda’s Board of Directors (the “Board”) is ultimately responsible for overseeing Takeda’s management of cybersecurity risk and provides strategic direction for Takeda’s information security program and responses to cybersecurity risks and incidents. |
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | Takeda’s CISO generally provides an annual update to the Board on the status of Takeda’s information security program, including significant developments, and the Board receives reports of any decisions by any of Takeda’s Business and Sustainability Committee, Portfolio Review Committee or Risk, Ethics and Compliance Committee (see “Item 6. Directors, Senior Management and Employees—C. Board Practices—Takeda Executive Team”) related to cybersecurity. In addition, the Board reviews and approves the Enterprise Risk Assessment, which includes significant cybersecurity risk matters, on an annual basis. On an as-needed basis, the Board is informed of, and provides strategic direction on, significant cybersecurity risks or incidents, if and when identified, by the CISO and CDTO. |
Cybersecurity Risk Role of Management [Text Block] | The Risk, Ethics & Compliance Committee (“RECC”) is the governing management committee responsible for overseeing risk management, including cybersecurity risk. The RECC is composed of the Takeda Executive Team, including Takeda’s CDTO and is chaired by Takeda’s Chief Ethics and Compliance Officer. In addition, Takeda’s CISO attends RECC meetings for relevant agenda items and generally provides an update to the RECC on the status of Takeda’s information security program, including significant developments, on at least an annual basis. On an as-needed basis, DD&T senior management escalates decisions regarding significant cybersecurity risks to the RECC, which also reviews and approves Takeda’s annual Enterprise Risk Assessment before it is approved by the Board. For a description of the relevant expertise of the CISO and of management’s role and processes in assessing and managing material risks from cybersecurity threats, see “—Risk management and strategy—Cybersecurity Risk Management Framework.”
|
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The Risk, Ethics & Compliance Committee (“RECC”) is the governing management committee responsible for overseeing risk management, including cybersecurity risk. The RECC is composed of the Takeda Executive Team, including Takeda’s CDTO and is chaired by Takeda’s Chief Ethics and Compliance Officer. In addition, Takeda’s CISO attends RECC meetings for relevant agenda items and generally provides an update to the RECC on the status of Takeda’s information security program, including significant developments, on at least an annual basis. On an as-needed basis, DD&T senior management escalates decisions regarding significant cybersecurity risks to the RECC, which also reviews and approves Takeda’s annual Enterprise Risk Assessment before it is approved by the Board. For a description of the relevant expertise of the CISO and of management’s role and processes in assessing and managing material risks from cybersecurity threats, see “—Risk management and strategy—Cybersecurity Risk Management Framework.”
|
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | Our CISO has over 30 years of experience in information technology, including more than 10 years serving in a CISO capacity at companies in various industries, including pharmaceuticals. Experienced and trained cyber risk professionals in the Cybersecurity & Risk team (“TCR”) within Takeda’s global data, digital & technology function (“DD&T”), many of whom hold certifications from established cybersecurity organizations |
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | The Risk, Ethics & Compliance Committee (“RECC”) is the governing management committee responsible for overseeing risk management, including cybersecurity risk. The RECC is composed of the Takeda Executive Team, including Takeda’s CDTO and is chaired by Takeda’s Chief Ethics and Compliance Officer. In addition, Takeda’s CISO attends RECC meetings for relevant agenda items and generally provides an update to the RECC on the status of Takeda’s information security program, including significant developments, on at least an annual basis. On an as-needed basis, DD&T senior management escalates decisions regarding significant cybersecurity risks to the RECC, which also reviews and approves Takeda’s annual Enterprise Risk Assessment before it is approved by the Board. For a description of the relevant expertise of the CISO and of management’s role and processes in assessing and managing material risks from cybersecurity threats, see “—Risk management and strategy—Cybersecurity Risk Management Framework.”
|
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |