7 unchanged sentences
We employ a multi-layered approach to data security and data privacy.
−Removed: This approach begins with our information security program, which leverages National Institute of Standards and Technology, SP 800-53.
+Added: This approach begins with our information security program, which leverages the National Institute of Standards and Technology Cybersecurity Framework.
Our program includes policies and standards that delineate requirements for the implementation and on-going maintenance of our information systems as well as security responsibilities for all personnel.
6 unchanged sentences
Incidents that are subject to escalation are initially evaluated by a team of IT security personnel led by our Chief Information Security Officer.
−Removed: If the incident is sufficiently severe, it will trigger our cybersecurity incident response plan, which is carried out by a cross-functional team of professionals who ultimately report findings and suggest action plans to our senior leadership team and Genworth.
−Removed: In accordance with the plan, we assess, contain and eradicate the threat and notify relevant external parties.
+Added: If the incident is sufficiently severe, it will trigger our cybersecurity incident response plan, which is carried out by a cross-functional team who ultimately report findings and suggest action plans to our senior leadership team and Genworth.
+Added: In accordance with
+Added: the plan, we assess, contain and eradicate the threat and notify relevant external parties.
We engage with third parties to assist with the research and evaluation, if deemed necessary.
1 unchanged sentence
Third parties who hold sensitive data are subject to our risk assessment process and vendor management due diligence procedures, which include an evaluation of cybersecurity risk.
−Removed: We have not identified any risks from cybersecurity incidents or threats that have materially affected our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term.
+Added: Based on the information available as of the date of this Annual Report on Form 10-K, we believe that risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and as of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so.
+Added: However, there can be no guarantee that we will not be the subject of future successful cybersecurity attacks, threats or incidents that may materially affect our business strategy, results of operations or financial condition.
Additional information on cybersecurity risks we face can be found in “Item 1A Risk Factors” of this Annual Report.
2 unchanged sentences
The Chief Information Security Officer has over 19 years of experience in information security, technology audit, and technology operations and includes the design, implementation, and maintenance of greenfield cybersecurity programs for regulated specialty insurance and software-as-a-service companies.
−Removed: Chief Information Security Officer has a master’s degree in information technology with a specialization in cybersecurity augmented with professional designations including the Amazon Web Services (“AWS”) Certified Solutions Architect Associate, AWS Certified Security - Specialty, Global Information Assurance Certification (“GIAC”) Cloud Security Automation, GIAC Certified Intrusion Analyst, GIAC Penetration Tester, GIAC Web Application Penetration Tester, and Certified Information Systems Security Professional.
+Added: The Chief Information Security Officer has a master’s degree in information technology with a specialization in cybersecurity augmented with numerous professional designations.
The Chief Information Security Officer receives reports on potential cybersecurity threats from throughout the business on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.
3 unchanged sentences
At least quarterly, the Risk Committee meets with management and reviews reports related to the status of our information technology related risks, which includes information such as the status of our environment, employee education, penetration testing, server patching, systems availability, as well as debriefs of Company cybersecurity tabletop exercises, director education sessions on a variety of topics concerning cybersecurity, and annual assessment.
−Removed: The Committee also reviews the Chief Compliance Officer’s quarterly report, which includes information regarding certain data security incidents that meet the risk criteria for inclusion in the report.
−Removed: Management also keeps the Committee apprised of changes in the threat landscape, such as new projects or strategies that may involve cybersecurity risks, evolving trends, and cyber incidents that involve our customers and suppliers.
−Removed: At least annually, we present a cybersecurity report to our full Board of Directors along with semiannual briefings.
+Added: The Risk Committee also reviews the Chief Compliance Officer’s quarterly report, which includes information regarding certain data security incidents that meet the risk criteria for inclusion in the report.
+Added: Management also keeps the Risk Committee apprised of changes in the threat landscape, such as new projects or strategies that may involve cybersecurity risks, evolving trends, and cyber incidents that involve our customers and suppliers.
+Added: At least annually, management presents a cybersecurity report to our full Board of Directors along with semiannual briefings.
These sessions may cover, among other topics, the information security organization, material risks, technical threats, information technology security infrastructure, patching and vulnerability management, cybersecurity incidents, an annual cybersecurity tabletop exercise and incident preparedness, supplier management, security awareness training, cybersecurity personnel/staffing and a cybersecurity threat assessment.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.