Merck & Co., Inc.

Item 1C of Form 10-K describes the registrant's cybersecurity risk management, strategy, and governance. The Company employs a dedicated CISO and integrates cybersecurity oversight into its enterprise risk management program, reporting to the Audit Committee. The Company states it has been targeted by cyber-attacks but asserts these have not materially affected its business, financial condition, or results of operations as of the report date. No specific incident, materiality determination, or data breach is disclosed.