4 unchanged sentences
We have an enterprise-wide approach to security with the objectives of protecting client data and funds, and preventing security incidents that could adversely affect the confidentiality, integrity, or availability of our information systems and data that resides in those systems, while also improving our system resilience with the aim of minimizing the impact to our business when incidents do occur.
−Removed: In connection with our business, we collect, host, store, transfer, process, disclose, use, secure, retain and dispose of large amounts of personal and business information about our clients, employees of our clients, our vendors and our employees, contractors and temporary staff.
+Added: In connection with our business, we collect, host, store, transfer, process, disclose, use, secure, retain and dispose of large amounts of personal and business information about our clients, employees of our clients, our vendors, our partners, and our employees, contractors and temporary staff.
We also collect significant amounts of funds from the accounts of our clients and transmit them to their employees, tax authorities and other payees.
As the global environment continues to grow increasingly hostile and attacks on information technology systems continue to grow in frequency, complexity and sophistication, we are regularly targeted by unauthorized parties using malicious tactics, code and viruses.
−Removed: Although this is a global problem, it may affect our businesses more than other businesses because malevolent parties may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of, and the client funds that we collect and transmit.
+Added: Although this is a global problem, it may affect our businesses more than other businesses because unauthorized parties may focus on the amount and type of personal and business information that our businesses collect, host, store, transfer, process, disclose, use, secure, retain and dispose of, and the client funds that we collect and transmit.
ADP has implemented a cybersecurity program designed to assess, identify, and manage risks from cybersecurity threats.
19 unchanged sentences
• Third-Party Risk Management.
−Removed: We maintain a third-party risk management process, designed to identify and manage risks associated with our vendors and other third parties, that includes conducting security assessments prior to engagement and periodically during the engagement.
+Added: We maintain a third-party risk management process , designed to identify and manage risks associated with our vendors, our partners and other third parties, that includes conducting security assessments prior to engagement and periodically during the engagement.
We also seek to include security and privacy terms, where appropriate, in our contracts with third-party service providers that require third parties to maintain security controls to protect our data and notify us in the event of a cybersecurity incident.
15 unchanged sentences
The current CISO has served in various roles in cybersecurity and information technology for over 25 years and has attained the professional certification of Certified Information Security Manager.
−Removed: Our board of directors and our audit committee are actively engaged in the oversight of our global cybersecurity program.
−Removed: Our audit committee receives regular, quarterly reports on these matters from our CSO and leadership from our global product and technology organization, including on the status of projects to strengthen the company’s cybersecurity systems and improve cyber readiness, as well as on existing and emerging threat landscapes.
+Added: Our board of directors is actively engaged in the oversight of our global cybersecurity program.
+Added: Our board of directors receives regular, quarterly reports on these matters from our CSO and leadership from our global product and technology organization, including on the status of projects to strengthen the Company’s cybersecurity systems and improve cyber readiness, as well as on existing and emerging threat landscapes.
+Added: In addition, the corporate development & technology committee of our board of directors receives regular, quarterly reports on our global product security and resiliency program led by leadership from our global product and technology organization with assistance from our CSO.
Concurrent and in addition to these reports, our chief administrative officer (“CAO”) (who oversees legal, security and compliance matters) provides a legal, regulatory and ethics update at each meeting of the audit committee of our board of directors, which includes matters of cybersecurity, as appropriate.
1 unchanged sentence
Our global cybersecurity program is subject to an annual third-party assessment overseen by our board of directors and this assessment reviews all aspects of our cyber program.
−Removed: Findings are reported to our board and, in response, ADP develops initiatives to improve our maturity across each of the pillars of the NIST Cybersecurity Framework.
−Removed: The status of these initiatives is then reviewed with our audit committee during its quarterly meetings.
+Added: Findings are reported to our board of directors and, in response, ADP develops initiatives to improve our maturity across each of the pillars of the NIST Cybersecurity Framework.
+Added: The status of these initiatives is then reviewed with our board of directors during its quarterly meetings.
This governance process encourages an environment of continuous improvement.
−Removed: In advance of these quarterly meetings, members of our audit committee with cybersecurity expertise informally meet with our CAO, CSO, and other members of leadership, as appropriate, to advise and provide additional guidance and industry insights to the Company.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.