2 unchanged sentences
Cybersecurity.
−Removed: Our information technology networks, those of our operators and managers and those of third parties on whom we rely are important enablers to our ability to perform day-to-day operations of our business.
−Removed: Our business operations depend on the secure collection, storage, transmission and other processing of proprietary, confidential or sensitive data.
+Added: Risk Management and Strategy
We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats.
−Removed: Our cybersecurity program includes several safeguards such as access controls, multi-factor authentication, continuous monitoring and alerting systems for internal and external threats and external vulnerability testing.
−Removed: Additionally, we conduct regular evaluation of our cybersecurity program, encompassing internal reviews and third-party assessments to ensure its effectiveness and resilience.
−Removed: Our board retains ultimate oversight of cybersecurity risk, which it manages through our enterprise risk management program.
−Removed: Our board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee.
−Removed: The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness and seeking to confirm that management's response to potential cybersecurity incidents is timely and effective.
−Removed: At least annually, the Audit Committee reviews with the management team our cybersecurity risk exposures and the steps that management has taken to monitor and control such exposures.
−Removed: This review may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and third parties.
−Removed: The scope and focus of each review are determined based on current priorities and emerging issues in cybersecurity.
−Removed: Management and Cybersecurity Working Group
−Removed: Reporting to the Chief Operating Officer, our Vice President of Information Technology, with extensive cybersecurity knowledge and skills from over 15 years of relevant work experience at our company and elsewhere, leads the team responsible for developing and implementing our information security program across our business.
−Removed: This team comprises individuals with relevant educational and technical experience, including a dedicated IT Systems & Security Administrator, with responsibility for various aspects of cybersecurity within our organizations.
−Removed: This team works closely with the Legal department to oversee compliance and regulatory and contractual security requirements.
−Removed: Our Chief Operating Officer also leads our Cybersecurity Incident Management Team, which is comprised of a cross-functional team including Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders.
−Removed: These individuals meet regularly and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents.
−Removed: Our Chief Operating Officer is responsible for reporting on cybersecurity and information technology to the Audit Committee.
−Removed: Information Security Program
−Removed: Our Vice President of Information Technology and his information security team provide regular reports to the Chief Operating Officer and other relevant teams on various cybersecurity threats, assessments and findings.
−Removed: In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors or other third parties to provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks.
−Removed: Our management team identifies and assesses information security risks using industry practices, including those informed by the National Institute of Standards and Technology.
−Removed: To ensure that cybersecurity is an organization-wide effort, we provide mandatory cybersecurity training at least annually for all employees with network access, including training designed to simulate and help prevent phishing and other social engineering attacks.
+Added: Our risk management strategy begins with identifying areas of risk through risk assessment and an annual review of our practices and policies against the National Institute of Standards and Technology, or NIST, Cybersecurity Framework.
+Added: This framework encompasses six major focus areas and 106 subcategories.
+Added: The results of each assessment are thoroughly analyzed to strengthen our security posture and maintain a comprehensive cybersecurity program.
+Added: In connection with these focus areas, we have implemented a variety of technical, physical and administrative controls to proactively prevent, detect and mitigate cybersecurity threats.
+Added: These measures are designed to limit the impact of potential breaches by employing advanced logging and monitoring, robust access controls, multifactor authentication, firewalls, anti-malware and antivirus solutions, endpoint detection and response systems, network inspection tools, intrusion prevention mechanisms, content filtering and comprehensive patch and vulnerability management.
+Added: Endpoints are routinely reviewed and scanned, with our Information Technology team addressing any identified issues to ensure ongoing protection.
+Added: We also engage external vendors to conduct external vulnerability scanning and assess our policies and practices.
+Added: To safeguard critical systems, we maintain encrypted, immutable backups and conduct regular testing to confirm their confidentiality, integrity and availability.
+Added: These efforts are reinforced by routine disaster recovery tabletop exercises and restore testing, ensuring that our organization is prepared for any potential disruptions.
+Added: In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors and other third parties to provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks.
+Added: For instance, we engage third-party consultants to perform annual walkthroughs and design testing of information technology, or IT, general controls on behalf of our Internal Audit team, as well as to test IT control effectiveness throughout the year.
+Added: We have developed processes to identify and manage cybersecurity risks from our service providers .
+Added: We assess our operators and managers through due diligence surveys, interviews and risk evaluations.
+Added: We take cybersecurity and data privacy considerations into account when we source, select and engage with our third-party service providers.
+Added: Moreover, we document our third-party vendors and suppliers in a centralized registry and review their cybersecurity practices through diligence meetings and SOC2 report evaluations for security, availability of data, processing integrity, confidentiality and privacy controls.
+Added: These measures help ensure that our partners adhere to best practices and maintain safeguards for our data.
We also employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or otherwise implicating the third-party technology and systems we use.
−Removed: Additionally, we maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our cybersecurity and information technology infrastructure.
−Removed: Incident Response
−Removed: The Cybersecurity Incident Management Team maintains and oversees an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents.
+Added: Lastly, we maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our cybersecurity and information technology infrastructure.
+Added: As of December 31, 2024, we are not aware of any cybersecurity threats or incidents that have materially affected us;
+Added: however, there can be no guarantee that we will not be the subject of future attacks, threats or incidents that may have a material impact on our business strategy, results of operations or financial condition.
+Added: Additional information on cybersecurity risks we face can be found in Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K under the heading “A breach of, or failure in, information technology systems on which we rely could materially and adversely impact us,” which should be read in conjunction with the foregoing information.
+Added: Reporting to the Chief Operating Officer, our Vice President of Information Technology , who has extensive cybersecurity knowledge and skills from over 16 years of relevant work experience at our company and elsewhere, leads our Information Technology team, which is responsible for developing and implementing our information security program across our business.
+Added: The Information Technology team comprises individuals with relevant educational and technical experience, including a dedicated IT Systems & Security Administrator.
+Added: It works closely with the Legal department to oversee compliance and regulatory and contractual security requirements.
+Added: Our Chief Operating Officer leads the Cybersecurity Incident Management Team, a cross-functional team that comprises Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders.
+Added: These individuals meet regularly and receive reports of, and monitor, the prevention, mitigation, detection and remediation of cybersecurity incidents.
+Added: Our Chief Operating Officer is also responsible for reporting on cybersecurity and information technology to the Audit Committee.
+Added: We maintain and periodically review and update an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents.
The incident response plan sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.
1 unchanged sentence
The incident response plan also specifies the use of third-party experts for legal advice, consulting and cyber incident response.
−Removed: Material Cybersecurity Risks, Threats and Incidents
−Removed: While we employ several measures to prevent, detect and mitigate cybersecurity threats, there is no guarantee such efforts will be successful.
−Removed: We also rely on information technology and other third-party vendors to support our business, including securely processing personal, confidential, financial, sensitive or proprietary and other types of information.
−Removed: Despite our efforts to improve our ability, and the ability of relevant third parties', to protect against cyber threats, we may not be able to protect all information, systems, products and services.
−Removed: While we are not aware of any cybersecurity incidents that have materially affected us to date, there can be no guarantee that we will not be the subject of future attacks, threats or incidents that may have a material impact on our business strategy, results of operations or financial condition.
−Removed: Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report on Form 10-K under the heading "A breach of information technology systems on which we rely could materially and adversely impact us," which should be read in conjunction with the foregoing information.
+Added: Our board has the ultimate oversight of cybersecurity risk, which it manages through our enterprise risk management program.
+Added: Our board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee.
+Added: The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness and making sure that management's response to potential cybersecurity incidents is timely and effective.
+Added: At least annually, the Audit Committee reviews with the management team our cybersecurity risk exposures and the steps that management has taken to monitor and control such exposures.
+Added: This review may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and other third-party partners.
+Added: The scope and focus of each review are determined based on current priorities and emerging issues in cybersecurity.
+Added: In addition, we engage third-party consultants to test our IT control effectiveness throughout the year, and any known exceptions and test results are communicated to management and the Audit Committee on a quarterly basis.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.