12 unchanged sentences
Security Awareness Education .
−Removed: Understanding the need for regular cybersecurity training, we have instituted a mandatory training program for all employees.
+Added: Understanding the need for regular cybersecurity training, we have instituted a mandatory training program for all employees around information security and data privacy.
Technical Safeguards .
8 unchanged sentences
These processes include a review of security controls and supplier contractual obligations for security and data protection requirements.
−Removed: Our Audit Committee is primarily responsible for assisting our Board of Directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and management, including with respect to risks and incidents relating to cybersecurity threats, compliance with disclosure requirements, cooperation with law enforcement, cybersecurity and other information securities policies and practices and related internal controls.
+Added: Cybersecurity Service Providers and Third-party Consultants .
+Added: We engage cybersecurity consultants and other third parties to assess and enhance our information security practices.
+Added: These third parties conduct assessments, penetration testing, and vulnerability assessments to identify weaknesses and recommend improvements.
+Added: We also utilize third-party tools and technologies to support our efforts to enhance our cybersecurity functions.
+Added: Our Audit Committee is primarily responsible for assisting our Board of Directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and cyber governance.
+Added: In that capacity, our Audit Committee conducts quarterly reviews of, and meets with our Chief Information Officer and other senior management to discuss technology and cybersecurity risks and the Company’s risk assessment and risk management policies, practices, programs and/or procedures that have been adopted to monitor, control, mitigate and manage such risks.
+Added: In addition, the Audit Committee reviews management’s reports on topics, including risks and incidents relating to cybersecurity threats, compliance with disclosure requirements, cooperation with law enforcement, cybersecurity and other information securities policies and practices and related internal controls.
The Audit Committee reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration.
−Removed: In that capacity, our Audit Committee conducts quarterly reviews of, and meets with our Chief Information Officer and other senior management to discuss, technology and cybersecurity risks and the risk assessment and risk management policies, practices, programs and/or procedures that we have adopted to monitor, control, mitigate and manage such risks.
Our Board of Directors is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging by receiving scheduled and requested updates on our strategy and evolving threat landscape as well as bolstering existing cybersecurity knowledge and continued education of recent cybersecurity trends.
−Removed: We are developing processes to continuously monitor, analyze emerging threats, and to develop and implement risk mitigation strategies and our management team plays a pivotal role in assessing and managing material risks from cybersecurity threats.
−Removed: As our first key investment, we have hired our Director of Information Security with over 20 plus years of information security experience to oversee our cybersecurity program.
−Removed: Our Director of Information Security reports up to our Chief
−Removed: Information Officer.
−Removed: Together our Director of Information Security and Chief Information Officer have over 40 years of combined experience.
+Added: We are continuing to develop and refine processes to continuously monitor, analyze emerging threats, and to develop and implement risk mitigation strategies and our management team plays a pivotal role in assessing and managing material risks from cybersecurity threats.
+Added: Our Chief Information Officer, who has served in various leadership roles in information technology for over 20 years, provides leadership for our cybersecurity team.
+Added: He also leads our overall corporate technology team, which has over 20 years of combined information security experience.
+Added: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.
+Added: However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.
+Added: For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section entitled “Risk Factors— We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, integrated software in our aircraft, as well as our customer and other confidential data or proprietary information processed by us or third-party vendors.”
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.