12 unchanged sentences
For example, we subject our IT suppliers to the Sarbanes-Oxley ("SOX") and payment card industry ("PCI") compliance standards where applicable.
−Removed: To certify our policies and processes to International Standards Organization (ISO)/ International Electrotechnical Commission (IEC) 27001, we are engaging a third-party consulting firm to conduct a gap analysis on our cybersecurity compliance.
−Removed: After achieving compliance, we expect to engage a third-party auditor to ensure we are compliant on an annual basis.
+Added: As a publicly traded company and given the industry in which we operate, we have established a risk-based strategy informed by numerous cybersecurity frameworks from regulatory bodies such as PCI, SOX, FAA, TSA, DOT, NIST and DoD.
+Added: We use the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
+Added: This does not imply that we meet all of the technical standards, specifications or requirements under any of these frameworks.
Achieving compliance with any cybersecurity standard does not guarantee that controls cannot be broken, bypassed, or circumvented by zero-day vulnerabilities, or malicious threat actors.
27 unchanged sentences
Our CISO leads our day-to-day data security and customer privacy efforts — overseeing operations, cybersecurity, privacy risk and compliance.
−Removed: The CISO, who has more than 30 years of experience reports daily to our chief information officer (CIO), monthly to the risk and compliance committee (consisting of the president and executive leadership) and quarterly to our board.
+Added: The CISO, who has more than 30 years of experience reports regularly to our chief executive officer (CEO), monthly to the risk and compliance committee (consisting of executive leadership) and quarterly to our board.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.