1 unchanged sentence
Cybersecurity
−Removed: Our Cybersecurity program is managed by our Chief Information Security Officer (CISO) .
−Removed: The CISO is responsible for developing and managing the overall strategy, leading the response to cybersecurity incidents and reporting to the Board.
−Removed: The Audit Committee of the Board monitors our information security programs, including our cybersecurity risk management program, and receives updates quarterly, or more frequently as determined appropriate, from management on our cybersecurity program and systems protection.
−Removed: Our CISO has over twenty-five years of experience in cybersecurity and holds active Certified Information Systems Security Professional and Certified Information Security Manager certifications.
−Removed: Our policies require teammates, contractors, service providers and suppliers who become aware of a cybersecurity incident or the individual’s supervisor to immediately report the cybersecurity incident to the appropriate reporting channels, which include the CISO.
−Removed: In the event of a cybersecurity incident, in addition to the standing members, teammates would be selected to serve on the Cybersecurity Incident Response Team (CIRT) based on the facts and circumstances of the particular cybersecurity incident.
−Removed: Additionally, our outside legal counsel is held on retainer to assist with our response to cybersecurity incidents.
+Added: Risk Management and Strategy
+Added: Our cybersecurity risk management processes are integrated within our enterprise risk management framework.
+Added: We conduct periodic cybersecurity risk assessments to identify, evaluate and prioritize threats and vulnerabilities across our information technology environment and business operations.
+Added: These assessments consider the evolving threat landscape, vulnerabilities in our systems and those of our third-party service providers and potential impacts to our business.
+Added: Identified risks are evaluated based on likelihood and potential business impact, and we implement controls and mitigation measures aligned with business priorities.
We model our cybersecurity program to align with the practices and standards referenced within the National Institute of Standards and Technology cybersecurity framework .
11 unchanged sentences
We maintain a Cybersecurity Incident Response Plan (CIRP) to assist in promptly responding to, resolving and recovering from cybersecurity incidents.
−Removed: The CIRP includes guidelines for assessing, identifying, managing, reporting, including disclosure of material breaches with the SEC, and remediating cybersecurity incidents.
−Removed: Following a cybersecurity incident, external subject matter experts, including legal counsel are consulted to reduce the risk of further compromise to our information and to ensure proper reporting and documentation.
−Removed: The Audit Committee would be informed promptly of material cybersecurity incidents in the event that they arise.
−Removed: If a material cybersecurity incident were to occur, it could have a material effect on our business strategy, results of operations and financial condition .
+Added: The CIRP includes guidelines for assessing, identifying, managing, reporting and remediating cyber incidents, including protocols for disclosure of material breaches with the SEC.
+Added: Following a cybersecurity incident, we consult external subject matter experts, including legal counsel, to reduce the risk of further compromise to our information and to ensure proper reporting and documentation.
+Added: Material cybersecurity incidents are escalated to our disclosure committee and senior management for materiality assessment, and the Audit Committee is informed promptly of material cybersecurity incidents in the event that they arise.
For more information see Item 1A.
“Risk Factors” for the Risk Factor entitled “ Our operations depend on the proper functioning of information systems, and our business or results of operations could be adversely affected if we experience a cyberattack or other systems breach or failure .”
+Added: Our Cybersecurity program is managed by our Chief Information Security Officer (CISO) .
+Added: Our CISO works collaboratively with senior management, including the Chief Financial Officer, General Counsel, and other business leaders.
+Added: The CISO has eighteen years of experience in cybersecurity.
+Added: The CISO is responsible for developing and managing the overall strategy, leading the response to cybersecurity incidents and reporting to the Board .
+Added: Our policies require teammates, contractors, service providers and suppliers who become aware of a cybersecurity incident to immediately report it to their supervisor or the CISO through the appropriate reporting channels.
+Added: In the event of a cybersecurity incident, in addition to the standing members, teammates would be selected to serve on the Cybersecurity Incident Response Team (CIRT) based on the facts and circumstances of the particular cybersecurity incident.
+Added: Additionally, our outside legal counsel is held on retainer to assist with our response to cybersecurity incidents.
+Added: The Audit Committee of the Board has primary responsibility for oversight of our cybersecurity risk management program.
+Added: The Audit Committee receives updates from management at least quarterly, or more frequently as appropriate, on our cybersecurity program including the threat environment, program initiatives and investments, cyber insurance coverage, significant incidents or risks, and key metrics.
+Added: To date, we have not experienced any cybersecurity incidents that have materially affected , or are reasonably likely to materially affect, out business strategy, results of operations, or financial condition.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.