UNRESOLVED STAFF COMMENTS
−Removed: We had no unresolved SEC staff comments that were issued 180 days or more preceding December 31, 2024.
CYBERSECURITY
9 unchanged sentences
Our cybersecurity risk management program includes:
−Removed: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and our broader enterprise information technology environment;
+Added: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems, information, and our broader enterprise information technology environment;
• a cybersecurity team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, (3) vulnerability management program and (4) detection and response to cybersecurity incidents;
2 unchanged sentences
• cybersecurity awareness training for our employees, incident response personnel and senior management;
−Removed: • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents;
+Added: • a cybersecurity incident response plan that (1) includes procedures for responding to cybersecurity incidents and (2) is periodically tested through exercises;
• a third-party risk management process for critical information technology service providers, suppliers, and vendors.
4 unchanged sentences
Cybersecurity Governance
−Removed: Our Board of Directors consider cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.
−Removed: The Audit Committee oversees management’s implementation of our cybersecurity risk management program.
+Added: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.
+Added: In turn, the Audit Committee oversees management’s implementation of our cybersecurity risk management program.
The Audit Committee receives quarterly reports from management on our cybersecurity risks.
1 unchanged sentence
The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity.
−Removed: The full Board of Directors also receives periodic briefings from management on our cyber risk management program.
−Removed: Board of Directors members receive presentations on cybersecurity topics from a combination of our CDIO, CISO, Deputy General Counsel, internal security staff, external counsel or external experts, as part of the Board of Director’s continuing education on topics that impact public companies.
−Removed: Our management team, including our CDIO, CISO, Vice President and Deputy General Counsel – Chief Privacy and Data Protection Officer and additional members of the ECRG are responsible for assessing and managing our material risks from cybersecurity threats.
+Added: The full Board of Directors also receives periodic briefings from management on our cybersecurity risk management program.
+Added: Board of Director members receive presentations on cybersecurity topics from a combination of our CDIO, CISO, Deputy General Counsel – Chief Privacy and Data Protection Officer, internal security staff, external counsel or external experts, as part of the Board of Director’s continuing education on topics that impact public companies.
+Added: Our management team, including our CDIO, CISO, Deputy General Counsel – Chief Privacy and Data Protection Officer and additional members of the ECRG are responsible for assessing and managing our material risks from cybersecurity threats.
The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.