8 unchanged sentences
Risk Management and Strategy
−Removed: Insider Risk Management .
−Removed: We recognize that not all threats are external.
−Removed: We have an insider risk management program and are working to improve our data loss protection technology to protect our critical data.
−Removed: Security Awareness Education .
−Removed: Understanding the need for regular cybersecurity training, we have instituted a mandatory training program for all employees around information security and data privacy.
−Removed: Technical Safeguards .
−Removed: We have improved our endpoint security postures through the implementation of an Enterprise Mobile Management system, and continue to increase our investment in strengthening email, DNS, and other network security services.
−Removed: Threat Detection and Response .
−Removed: In addition to aligning our cybersecurity risk management program to NIST standards, we have also engaged with third party providers of security information and event management and cybersecurity services to provide continuous monitoring and operational threat detection and response.
−Removed: Our partners integrate threat intelligence into their platforms, providing us with a proactive view of possible threats.
−Removed: Incident Response .
−Removed: We have implemented a holistic review of incident response, with workflows in place for cybersecurity incidents, including provisions for assessing materiality, and defined escalation procedures.
−Removed: Third Party Risk Management .
−Removed: To manage third-party risks, our cybersecurity team evaluates our partners, to provide an additional layer of scrutiny, and supervises and identifies material risks associated with the use of third-party service providers.
−Removed: These processes include a review of security controls and supplier contractual obligations for security and data protection requirements.
+Added: We maintain a cybersecurity risk management program to assess, identify, and address significant cybersecurity risks, incorporating them into our broader enterprise risk management processes.
+Added: Our program is guided by recognized industry standards and is designed to be risk-based and adaptable as our business, technology, and threat landscape evolve.
+Added: We rely on a combination of internal resources and, when appropriate, third-party service providers to support activities such as security assessments, vulnerability detection, and testing.
+Added: Key elements of our cybersecurity program include:
+Added: • Risk assessment and prioritization processes aim to identify cybersecurity risks, including those related to third-party service providers , and to facilitate remediation planning and tracking.
+Added: • Employee security awareness and training are designed to improve cybersecurity hygiene and help employees recognize and report suspected threats, such as phishing and social engineering.
+Added: • Technical and administrative safeguards to minimize the likelihood and impact of cybersecurity incidents, including endpoint security, identity and access management, and network protection.
+Added: • Monitoring and detection practices, including the use of security tooling and, when appropriate, third-party services, are designed to help identify indicators of compromise and support response activities.
+Added: • Incident response processes designed to support investigation, containment, remediation, recovery, and escalation, including consideration of cybersecurity incident materiality and related disclosure requirements.
Cybersecurity Service Providers and Third-party Consultants .
−Removed: We engage cybersecurity consultants and other third parties to assess and enhance our information security practices.
+Added: In addition to our internal cybersecurity team, we engage cybersecurity consultants and other third parties to assess and enhance our information security practices.
These third parties conduct assessments, penetration testing, and vulnerability assessments to identify weaknesses and recommend improvements.
We also utilize third-party tools and technologies to support our efforts to enhance our cybersecurity functions.
−Removed: Our Audit Committee is primarily responsible for assisting our Board of Directors in fulfilling its ultimate oversight responsibilities relating to risk assessment and cyber governance.
−Removed: In that capacity, our Audit Committee conducts quarterly reviews of, and meets with our Chief Information Officer and other senior management to discuss technology and cybersecurity risks and the Company’s risk assessment and risk management policies, practices, programs and/or procedures that have been adopted to monitor, control, mitigate and manage such risks.
−Removed: In addition, the Audit Committee reviews management’s reports on topics, including risks and incidents relating to cybersecurity threats, compliance with disclosure requirements, cooperation with law enforcement, cybersecurity and other information securities policies and practices and related internal controls.
−Removed: The Audit Committee reports any findings and recommendations, as appropriate, to the full Board of Directors for consideration.
−Removed: Our Board of Directors is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging by receiving scheduled and requested updates on our strategy and evolving threat landscape as well as bolstering existing cybersecurity knowledge and continued education of recent cybersecurity trends.
−Removed: We are continuing to develop and refine processes to continuously monitor, analyze emerging threats, and to develop and implement risk mitigation strategies and our management team plays a pivotal role in assessing and managing material risks from cybersecurity threats.
−Removed: Our Chief Information Officer, who has served in various leadership roles in information technology for over 20 years, provides leadership for our cybersecurity team.
−Removed: He also leads our overall corporate technology team, which has over 20 years of combined information security experience.
+Added: The Audit Committee of our Board of Directors provides oversight of cybersecurity risks and receives updates from management on cybersecurity matters.
+Added: The Chief Information Security Officer (“CISO”) and management team are responsible for the day-to-day operation of our cybersecurity program, including assessing and managing material risks from cybersecurity threats and reporting relevant matters to the Audit Committee and, as appropriate, the full Board.
+Added: We may engage third-party service providers and consultants to assist with aspects of our cybersecurity program, and management oversees these relationships consistent with our risk management practices.
In 2025, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.
−Removed: However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.
−Removed: For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the section entitled “Risk Factors— We are subject to cybersecurity risks to our operational systems, security systems, infrastructure, integrated software in our aircraft, as well as our customer and other confidential data or proprietary information processed by us or third-party vendors.”
+Added: For additional discussion of cybersecurity risks, see the section entitled “Risk Factors — Our business and reputation are impacted by information technology system failures and network disruptions.”
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.