16 unchanged sentences
As part of this process, we use the following tools and procedures:
−Removed: • utilizing “SecurityScorecard” (a third-party information security company that rates cybersecurity postures of corporate entities for the purposes of third-party management and information technology risk management), which provides an independent external enterprise view of our security posture with a focus on public-facing systems ;
+Added: • utilizing “Security Scorecard” (a third-party information security company that rates cybersecurity postures of corporate entities for the purposes of third-party management and information technology risk management), which provides an independent external enterprise view of our security posture with a focus on public-facing systems ;
• assessing, regularly developing, and executing on our preventative and detective controls, which we seek to align with current standards and best practices, including the incorporation of recommendations published by the National Institute of Standards and Technology in its cybersecurity framework, such as an annual audit of these internal controls;
1 unchanged sentence
• working with our cybersecurity vendors to adopt tooling and processes to provide high levels of protection.
−Removed: Cybersecurity Management and Board Oversight
+Added: Cybersecurity Management and Board of Directors Oversight
Our Board of Directors, through its Audit Committee, has primary responsibility for overseeing cybersecurity risk management and receives updates on the status of our cybersecurity program from our CISO.
−Removed: These updates are provided at least once per year, and often multiple times per year, in a special Audit Committee session and includes reports on our security posture and SecurityScorecard assessment (rating and benchmarking), incident response, and vulnerability management.
+Added: These updates are provided at least once per year, and often multiple times per year, in one or more Audit Committee meetings and include reports on our security posture and Security Scorecard assessment (rating and benchmarking), incident response, and vulnerability management, all of which is subsequently reported to the full Board of Directors by the chairperson of the Audit Committee.
The Audit Committee reviews and discusses with management our cybersecurity threats, vulnerabilities, defenses, and planned responses, including updates to our cybersecurity incident response plan (“IRP”), which has been approved by the Audit Committee.
Additionally, the Audit Committee receives and discusses reports from management with the purpose of identifying threats and vulnerabilities, and it monitors the effectiveness and progress of the actions and initiatives undertaken to mitigate such threats.
−Removed: Our cybersecurity program team is led by our CISO (who ultimately reports to the Chief Operating Officer).
+Added: Our cybersecurity program team is led by our CISO (who reports directly to the Chief Digital and Information Officer and, ultimately, to the Chief Operating and Customer Officer).
The cybersecurity leadership team (“CSLT”), which is chaired by our Chief Operating Officer and includes our Chief Financial Officer, Chief Legal Officer, Chief Information Officer, CISO, and Chief Privacy Officer, among others, collaborates with enterprise risk professionals and is supported by an established Information Security (“InfoSec”) function responsible for certain aspects of maintaining and monitoring our cybersecurity infrastructure.
13 unchanged sentences
The Assessment Committee is responsible for assessing, without unreasonable delay, the materiality of cybersecurity incidents reported to it, determining materiality and any necessary disclosures, and informing our disclosure committee of such determinations.
−Removed: In assessing materiality, the Assessment
−Removed: Committee will consult with internal and external advisors, as appropriate, and evaluate quantitative and qualitative factors to assess the impact and/or reasonably likely impacts of the cybersecurity incident.
+Added: In assessing materiality, the Assessment Committee will consult with internal and external advisors, as appropriate, and evaluate quantitative and qualitative factors to assess the impact and/or reasonably likely impacts of the cybersecurity incident.
For additional information regarding how cybersecurity threats have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition, see “ Risk Factors— ”:
1 unchanged sentence
• “— If we do not effectively implement our plans to migrate our technology infrastructure to the cloud, we could experience significant disruptions in our operations, which could have a material adverse effect on our results of operations and financial condition, ”
−Removed: • “— Cybersecurity attacks or threats or other unauthorized access or attempts to access to our systems, or those of third parties, have in the past, and may in the future, compromise the security of our systems and otherwise disrupt our normal operations, which could have a material adverse effect on our reputation, business, financial condition, results of operations and cash flows, ” and
−Removed: • “— Our independent, third-party authorized dealers may not be able to mitigate certain risks such as information technology and data security breaches, product liability, errors and omissions, and compliance with applicable laws and regulations.
+Added: • “— Cybersecurity attacks or threats or other unauthorized access or attempts to access to our systems, or those of third parties, have in the past, and may in the future, compromise the security of our systems and otherwise disrupt our normal operations, which could have a material adverse effect on our reputation, business, financial condition, results of operations and cash flows, ”
+Added: • “— Uncertainty in the development, deployment, and use of AI, including generative AI, in our products and services and across our operations could adversely affect our business, financial condition, results of operations, and reputation,” and
+Added: • “— Our independent, third-party authorized dealers may not be able to mitigate certain risks such as information technology and data security breaches, product liability, errors and omissions, and compliance with applicable laws and regulations which could have a material adverse effect on our business, financial condition, results of operations, and cash flows.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.