DePuy Synthes — GRC Separation Blueprint

Structure as one apex policy with subordinate policies beneath it. The apex is what you show a customer or an auditor first; the subordinates carry the detail. Every subordinate policy must name its owner, its review cadence, the committee that approves it, and the obligations it satisfies.

Apex

Subordinate set — the minimum viable list

Where it earns its keep

• Obligation extraction. Feed contracts, filings and customer security schedules; extract every commitment into a structured register with a source citation on each row. This is the highest-value use and the one most people skip.
• Reference sweep. Find every mention of the parent, its systems, its role titles and its escalation paths across the harvested library. Mechanical, exhaustive, and the thing humans miss most.
• Cross-regime mapping. Generate the first-pass control-to-regime mapping, then have a human confirm. Mapping is a good machine task because it is recall-bound, not judgement-bound.
• Gap analysis. Compare the harvested document against the obligation it is supposed to satisfy and list what is missing. Faster and more complete than a reviewer working from memory.
• Consistency enforcement. Terminology, defined terms, numbering, cross-reference integrity across a 200-document set.
• Draft-to-house-style conversion. Rewriting harvested procedures into the new entity's voice and template.

Where it must not be used unsupervised

• Risk acceptance and appetite. These are governance decisions with named accountable humans. Generated risk scores are indefensible in an audit.
• Anything inside the quality system. QMS documents carry validated state and change-control history. Generated content entering a controlled document without a controlled change is a finding waiting to be written.
• Regulatory determinations. Whether a product is a cyber device, whether a change is a new submission, whether an event is reportable — these are regulatory affairs judgements with legal consequences.
• Evidence. Never generate, summarise or reconstruct evidence. Evidence is produced by systems, not written.

Owns

• Quality system effectiveness across all manufacturing sites
• Regulatory inspection readiness and the status of every open observation, warning letter or consent decree exposure
• Recall and field action oversight
• Postmarket surveillance and vigilance performance, including reporting timeliness
• Product security posture for connected devices, sitting alongside the Audit Committee's enterprise cyber oversight

Why it is separate from the Audit Committee

Because the failure modes are different and the expertise is different. A committee that has to choose between reviewing revenue recognition and reviewing a rising complaint trend will always choose revenue. In a device company, the quality committee is the one that catches the problem eighteen months before it becomes a financial one.

Separation-specific duty

Own the regulatory transfer plan — every registration, certificate and licence in every market, with a named owner, a lead time and a revenue-at-risk figure. This is the committee that must be told when a market registration will not transfer inside the transition window.

Interface with security

Two standing items: connected-product vulnerability posture with time-to-remediate against your published commitment, and the status of computer system validation for any quality-critical system being migrated or re-hosted. Both are places where a security decision becomes a regulatory one.

Owns

• Approval of the control catalogue and every policy below the apex
• Risk acceptance within delegated limits; escalation above them
• Exception approval, renewal and expiry
• Security investment prioritisation and the roadmap for the build-by-date control set
• Transition exit readiness decisions — this committee decides whether a control has operated long enough to cut the parent dependency

Membership

Chaired by the CISO or the chief risk officer. Voting members: CIO, chief quality officer, head of regulatory affairs, general counsel, CFO delegate, head of manufacturing or supply chain, head of R&D or product. In a device company, quality and regulatory are voting members rather than guests — if they are guests, the committee cannot make a decision that touches a validated system, which is most decisions.

What it must produce as evidence

• Minutes with named attendees, decisions and dissents — not a slide deck
• A decision log with an identifier per decision, referenced from the risk and exception registers
• A quarterly attestation pack that feeds the Audit Committee

Not optional and not something you design freely — the quality management system regulation and ISO 13485 both prescribe management review inputs and outputs, and an inspector will ask for the records. The new entity needs its own management review cycle running before Day 1, with its own top management named, because a review conducted by the parent's management is not a review of your quality system.

Security's inputs to it

• Product security posture and open vulnerabilities in released product
• Validation status of quality-critical computer systems
• Data integrity incidents affecting quality records
• Supplier security findings for suppliers that touch product

Joint body with the former parent, governing every service the parent continues to provide. Treat the parent as your largest and most critical third party, because that is exactly what it now is.

Owns

• Service performance against the agreed schedules
• Evidence delivery — the artefacts the parent owes you for controls it operates on your behalf
• Deficiency escalation: when a parent-operated control fails, whose deficiency is it and who reports it
• Exit sequencing and the trigger conditions for cutting each service
• Incidents that cross the boundary, including who notifies which regulator

The four questions its charter must answer

1. When a control the parent operates fails, who records the deficiency and in whose register?
2. When an incident touches both entities, who leads, who notifies, and on whose clock does the reporting deadline run?
3. What evidence does the parent deliver, in what format, at what cadence, and what happens when it does not?
4. Who can extend a service, at what cost, and with whose approval?

Change Advisory Board · weekly

The most audit-visible control you will operate. Emergency change is where separations generate ITGC findings — everything is urgent, so everything becomes an emergency change, and the population of unapproved changes explodes. Cap emergency change as a percentage of total and report it monthly.

Data Governance Council · monthly

Owns classification, retention, privacy and the record of processing. In a device company it also owns quality record integrity, which is why it must include a quality representative.

Product Security Board · monthly

Scoped to connected product only — robotics, navigation, digital surgery, patient-facing applications. Owns threat modelling, the software bill of materials programme, disclosure decisions and premarket security content. Keep it separate from the enterprise steering committee; the audiences and the regulators are different.

AI Governance Council · monthly

Owns the AI inventory, use-case intake and risk classification. Needed on Day 1 rather than later, because separation-era productivity pressure is precisely when unreviewed AI tooling enters manufacturing and clinical workflows.

Site Security & OT Councils · monthly, per major site

One per significant manufacturing site, chaired by the site leader, not by IT. Plant managers do not attend committees run from headquarters, and OT security fails without them.

Third Party Risk Committee · monthly

Runs the novation queue during separation and the assessment queue afterwards. Prioritise by data sensitivity and product contact, not by contract value.

The people across the boundary were colleagues and will become a critical third party. The window in which they will still help you informally is short, and it closes when their own retained-organisation roles are confirmed. Extract what you need early.

• J&J service owners — the named operator of each retained service. Get the person who runs the query, not the person who owns the platform. Ask them what evidence they can realistically produce and in what format, before the schedules are drafted.
• J&J security operations — detection, triage and the notification interval you will depend on for disclosure. Agree the maximum interval in writing and rehearse it.
• Separation Management Office — controls the schedules, the timeline and the escalation route. Your reconciliation finding goes here.
• J&J privacy and legal — the intra-group transfer mechanisms you fall out of on Day 1, and the scope of the documentation licence.
• J&J procurement — which supplier agreements can be novated, which cannot, and where the volume pricing and security terms actually live.
• J&J internal audit and quality — historical findings, open observations and supplier audit reports. Ask now; entitlement to these becomes contested later.

• External auditor — engage on control environment scoping twelve to eighteen months out. Their view of in-scope systems will change your plan, and hearing it early is free.
• Notified body scheme manager — the individual who allocates audit capacity. A relationship here is worth more than a formal application.
• Auditing organisation for the multi-market programme — same logic, different scheme.
• Local regulatory representatives — in every market where DePuy is not established. These appointments have legal weight and lead time.
• Cloud provider account team — tenancy separation, enterprise agreement novation, and technical support for the carve-out. They have done this before; ask for their separation playbook.
• Insurance broker — cyber, product liability and D&O for a standalone entity, priced without the parent's tower. Start early; underwriters will ask control questions you need answers to.
• Outside counsel — separation agreement, privacy transfers, disclosure obligations.
• Peer security leaders in medtech — the people who have run a device separation. Two conversations here save six months of discovery.

Executive relationships get you permission. These relationships get you accuracy.

• Plant controls and automation engineers — they know what the machines talk to, which no diagram records.
• QA document control — knows every procedure, every reference and every change queue. Nothing in the harvest happens without them.
• The historian or MES administrator — usually one person per site, often with no backup. Identify them early; they are a single point of failure as well as a source.
• Field service engineers for robotic and navigation platforms — they know how systems connect inside hospitals, what remote support paths exist, and what customers actually asked about security.
• Service desk and contact centre supervisors — they see complaint intake, shadow tooling and where users work around process.
• The person who renews the certificates — often unnamed, sometimes nobody. Finding out it is nobody is itself the finding.

• Manufacturing execution and quality systems — every instance that moves, gets cloned or gets re-hosted requires requalification in the new environment. Map validation state onto the migration plan in the first quarter; it is the earliest reliable signal of whether the separation date is achievable.
• Audit trail continuity — migrated records must retain their audit trail. Confirm this in the migration design, not in validation testing, because by then the design is fixed.
• Sterilisation and environmental monitoring — parametric release and monitoring systems are quality-critical and often supplier-hosted. Supplier contracts, data ownership and record retrievability all need re-establishing.
• Traceability — lot and serial traceability from raw material to implanted device must survive the system split intact. A broken trace is a recall you cannot execute, and the regulator will treat it accordingly.

Device suppliers touch product, which makes supplier separation a quality event as well as a commercial one.

• Quality agreements name the parent. Every one needs novation or replacement, with vigilance and change-notification flow-downs re-established. A supplier who does not know to notify you of a process change is a recall in waiting.
• Supplier audits are the parent's work product. You may not be entitled to the reports. Budget for re-auditing critical suppliers, and prioritise by product contact rather than spend.
• Master agreements fragment. Group-level pricing and, more importantly, group-level security and data protection terms do not automatically follow. Re-negotiating security schedules across hundreds of suppliers is a multi-year programme; triage it hard.
• Single-source and sterilisation partners first. These carry the highest continuity risk and the longest requalification lead times.

Separation deadlines are absolute, so business teams buy their own tools rather than wait for a review process that has no staff yet. Most of the technical debt you will spend three years cleaning up gets created in this eighteen-month window. Two responses work:

• Make the paved path faster than the workaround. A pre-approved catalogue with a same-week intake for anything on it, and a genuine 48-hour triage for anything not. Speed is the control.
• Put security embeds into the business units. Product, manufacturing, quality and R&D each have different regulatory exposure and none of them will call a central function. An embedded layer is the only thing that keeps discovery ahead of accumulation.

Most of an orthopaedics portfolio is implants and instruments, which carry no cybersecurity obligation. The robotic, navigation and digital surgery platforms carry all of it — and they sit inside hospital networks, touch patient data, and have field service organisations with remote access paths.

Indicative mapping for programme design. Confirm each cell against the current text of the regime and your assessed scope before relying on it — CRA obligations in particular phase in on a staged timetable.

The pipeline for the robotic and navigation software is where the most regimes converge on a single control chain. Design it once, correctly, and it clears all of them.

The control chain

The metric that matters is not click rate. It is report rate and time to first report, because those are the two things that actually shorten an incident. A population that clicks and reports beats one that neither clicks nor reports, and click-rate-only programmes optimise for the wrong outcome.

How to run it

• Start early enough to have a trend by Day 1 — a single cycle is a data point, not a measurement.
• Report click rate, report rate and time to first report together. Never publish click rate alone.
• Follow up with coaching, never with punishment. Punitive programmes drive reporting down, which is the opposite of the goal.
• Tailor the pretexts to separation reality — payroll changes, benefits enrolment, new supplier portals, IT migration notices. These are exactly what attackers will use, and exactly what employees are conditioned to expect.
• Consult works councils before deploying simulation and monitoring at EU sites. In some jurisdictions this is a legal precondition, not a courtesy.

One metric set, three destinations: the audit committee quarterly, the annual governance disclosure, and the sustainability statement. Define each metric once with documented lineage, or the three will disagree and the filing is the one made under oath.

The standing pack

• Separation health — native coverage percentage, exit triggers met against services remaining, evidence completeness for the transition period.
• Control operation — emergency change ratio, access review completion with population reconciliation, open deficiencies by severity.
• Threat and vulnerability — time to remediate against published commitments, connected-product posture, open advisories.
• Behaviour — exception volume and renewal rate, phishing report rate and time to first report, shadow discovery rate, self-reported incidents.
• Regulatory — market transfer status, open observations, upcoming assessments.
• One narrative page — what changed, what worries you, what you need. The metrics inform; this page is what the committee actually discusses.

Feeding the disclosures

• Governance disclosure — board oversight structure, management's role, and the risk management processes. The described process must match what the minutes show actually happened.
• Sustainability statement — governance and business-conduct datapoints draw on the same governance structures, whistleblowing channels and training figures. Where a European sustainability reporting obligation applies, these become assured data, not marketing.
• Reconciliation — before filing, check the narrative against the minutes. A filing describing quarterly board oversight against minutes showing two meetings is a finding, and an avoidable one.

Enterprise supplier programmes tier by data sensitivity and spend. That is the wrong model for a device company, where a supplier who touches product carries recall exposure even if they never see a byte of personal data. Tier on both axes and report them separately.

• Native coverage — share of controls with no J&J dependency. The single cleanest indicator of separation health.
• Exit triggers met against services remaining — if triggers lag the schedule, you are heading for a date-driven exit and a material weakness.
• Evidence completeness for the transition period specifically — the gap that overall completeness hides.
• J&J evidence delivery against the agreed cadence — measures whether the delivery obligations you negotiated are working, while there is still time to escalate.
• Inherited exceptions re-decided against expired by default — tells you whether governance is actually operating or just recording.
• Licensed documents remaining against the licence countdown — one number, one date, unambiguous.
• Sites cut against sites rehearsed — if cuts are running ahead of rehearsals, stop.

• Phishing report rate and time to first report — the two that actually shorten an incident. Report click rate alongside, never alone.
• Exception volume, renewal rate and aged exceptions — the clearest measure of whether the paved path is faster than the workaround.
• Shadow technology discovery rate — rising discovery with falling onboarding time means the programme works. Flat is never the true number.
• Self-reported incidents as a share of total — a rising share is good news reported as bad news. Say so explicitly or the board will misread it.
• Time to onboard a tool through the approved path — the friction metric. It predicts the shadow discovery rate one quarter out.
• Training completion by role — reported because four regimes require it, never used to steer.

Do not report these

• Attacks blocked, alerts generated, emails filtered. Activity volume that no decision depends on. It also invites the question of what got through, which you then answer badly.
• Training completion alone. Necessary as evidence, useless as a signal.
• Raw vulnerability counts without age or exploitability. The count is a function of scanner coverage, so improving coverage looks like getting worse.
• Maturity scores presented as progress. A self-assessed score moving from 2.6 to 2.9 is not evidence of anything, and boards have learned to discount it.
• Percentages with an undefended denominator. The most common way a security report misleads without anyone intending to.

What you can honestly measure, and when

Your first audit covers a period that includes the transition. The evidence sits in the parent's identity platform, ticketing system and log store. When access ends, so does your ability to produce it — and the auditor will still ask.

A copy of the enterprise system in a new environment under a new legal entity is a new system. Validation does not travel with the data. Until requalification is complete you cannot release product against it.

The new entity needs its own gateway account, credentials and completed test-submission cycle before it can file electronically. Weeks of lead time, discovered late, and it sits directly in front of a statutory clock.

Transfers that ran under group-level binding rules or an intra-group agreement become third-country transfers the moment the entity leaves the group. Invisible until someone asks which mechanism covers the flow.

Several major markets treat a manufacturer change as a new registration with full technical review. Lead times can exceed the entire transition period, and the consequence is a revenue stop in a market you cannot serve.

The certificate transfer is achievable. Getting an audit slot is the constraint. Bodies remain heavily booked, and a missed slot cascades into every market that relies on the certificate.

Corporate development negotiates services top-down from a functional view. Your control catalogue produces a bottom-up dependency list. They will not match, and the controls whose dependency was never negotiated simply stop working at separation.

The service ends because the contract says so, the replacement control has never operated, and the first audit finds a testable population of zero. This is the most common route to a material weakness in a separation.

A copied identity estate brings orphaned accounts, parent service accounts, stale privileged groups and nested entitlements nobody can explain. All of it becomes your access review population and your findings.

Everything during separation is urgent, so everything becomes an emergency change with retrospective approval. The unapproved-change population explodes and the change control test fails.

Time synchronisation, name resolution, certificate services, licence servers and vendor support paths traverse the parent's core in ways no diagram shows. Cutting without a capture-based map halts lines.

Two of the most frequently reported cutover failures across large separations. Both preventable, both capable of taking out production or customer communications for days.

Complaints about your devices arrive at parent-operated call centres during transition. The statutory clock runs from awareness, and awareness now sits with a third party you do not control.

Identifier records key off the labeller's organisation identifier. A change of legal manufacturer cascades into record updates and, in some cases, new identifiers and relabelled product. Getting it wrong degrades recall traceability.

Vigilance and change-notification flow-downs run to the parent. A supplier who does not know to notify you of a process change is a recall in waiting, and supplier audit reports are the parent's work product you may not be entitled to.

A newly listed company gets relief on when it must report on internal control. Teams hear a year of grace. But the financial statement audit relies on those controls from Day 1, and the first assessment looks back over a period that includes the transition.

A newly listed entity owes timely disclosure of material incidents. During transition, detection, triage and often the first assessment of scope sit with the parent — but the disclosure obligation is yours, on your clock.

Separation agreements typically grant a limited, time-boxed licence to use the parent's documentation. The date passes, the replacement programme slipped, and the entity is operating on documents it no longer has the right to use — with the parent's name still in the footer.

One group wants the parent's rigour without the parent's funding. The other reads separation as permission — smaller company, fewer rules. Both are reacting to the same absence of a stated position, and whichever wins becomes permanent.