3 unchanged sentences
The Company maintains an Enterprise Risk Management (ERM) program that is designed to identify, analyze and manage risks, including risks from cybersecurity threats.
−Removed: This program scores, ranks, and reports risks to Company management based on the likelihood and impact the risk has relative to the strategic objectives and financial standing of the Company.
+Added: This program scores, ranks, and reports risks to Company managemen t based on the likelihood and impact the risk has relative to the strategic objectives and financial standing of the Company.
The Company maintains a cybersecurity risk management program that includes, but is not limited to, periodic risk assessments and employee awareness training initiatives, as well as the employment of security analytical and assessment tools.
We also maintain a cybersecurity incident response plan designed to help the Company defend against evolving cybersecurity threats, which sets out criteria for incident classification and procedures to escalate incidents to the appropriate stakeholders.
−Removed: We regularly monitor and assess the various components of our cybersecurity infrastructure, with the support of both internal and external resources.
+Added: Internally, we regularly monitor and assess the various components of our cybersecurity infrastructure, with the support of third-party consultants.
The Company has also established a process to identify and assess potential risks arising from cybersecurity threats associated with our use of critical third-party service providers.
4 unchanged sentences
The Chief Legal and Compliance Officer (CLO) , and our dedicated information technology (IT) team, lead the Company's overall cybersecurity efforts.
−Removed: The CLO oversees the Company’s cybersecurity risk management through regular meetings with the IT team to discuss, as appropriate, risks from cybersecurity threats.
−Removed: As part of our ERM process, our CLO and other senior management positions report on identified cybersecurity risks, as appropriate, to the Audit Committee and the Board.
−Removed: Management is responsible for the day-to-day management of risks we face, while our Board of Directors (Board), as a whole and through its committees, provides guidance on the oversight of risk management.
+Added: Together, our CLO and IT team have over 40 years of industry experience in implementing and managing information technology and information security systems, and members of our IT team maintain Certified Information Security Manager certifications.
+Added: The CLO oversees the Company’s cybersecurity risk management through regular meetings with the IT team to discuss, as appropriate, the risks and prevention of cybersecurity threats.
+Added: Cybersecurity incidents are escalated based on defined incident severity criteria to management.
+Added: As part of our ERM process, our CLO and other senior management positions report on identified cybersecurity risks, as appropriate, to the Audit Committee and the Board of Directors (Board).
+Added: Management is responsible for the day-to-day management of risks we face, while the Board as a whole and through its committees, provides guidance on the oversight of risk management.
The Audit Committee reviews the effectiveness of the Company’s governance and management of cybersecurity risks, including those relating to business continuity, regulatory compliance and data management.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.