13 unchanged sentences
• a vetting and management process for third party service providers , suppliers, and vendors
−Removed: Through this program, our IT/IS team identifies and executes improvements based upon its own assessments, public cybersecurity events and the identification of new risks by third parties , including our external cybersecurity consultants.
−Removed: As part of these continuous improvement efforts, there may be times when the IT/IS team prioritizes certain cybersecurity fixes or program improvements over other measures, which could lead to new known or unknown risks being identified on an ongoing basis.
+Added: Through this program, our IT/Cybersecurity team identifies and executes improvements based upon its own assessments, public cybersecurity events and the identification of new risks by third parties , including our external cybersecurity consultants.
+Added: As part of these continuous improvement efforts, there may be times when the IT/Cybersecurity team prioritizes certain cybersecurity fixes or program improvements over other measures, which could lead to new known or unknown risks being identified on an ongoing basis.
Cybersecurity threat actors are often highly sophisticated and nimble in their attacks.
1 unchanged sentence
We also engage in periodic testing programs, using both internal assets and external consultants, including penetration testing, and incorporate multiple layers of physical, logical and written controls into our cybersecurity risk management program.
−Removed: Our IT/IS team leverages centralized identity management, encryption configurations and technologies on the systems, devices, and third-party connections used in our operations.
+Added: Our IT/Cybersecurity team leverages centralized identity management, encryption configurations and technologies on the systems, devices, and third-party connections used in our operations.
We also maintain cyber liability insurance coverage.
4 unchanged sentences
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) oversight of cybersecurity and other information technology risks.
−Removed: The Committee oversees management’s implementation of our cybersecurity risk management program.
−Removed: The Committee receives quarterly reports from our Vice
−Removed: President and Chief Information Security Officer (CISO), in conjunction with other senior managers, on cybersecurity risks.
+Added: The Committee oversees management’s
+Added: implementation of our cybersecurity risk management program.
+Added: The Committee receives quarterly reports from our Vice President and Chief Information Security Officer ("CISO"), in conjunction with other senior managers, on cybersecurity risks.
In addition, these managers update the Committee, as necessary, regarding any material cybersecurity incidents, as well as incidents with lesser impact potential.
2 unchanged sentences
Our cybersecurity program includes an annual funding and forecast process, and we have further established processes to secure additional funding in response to emerging risks, threats and identified improvement opportunities.
−Removed: Our IS team, led by one of our Vice Presidents who also serves as our CISO, is responsible for assessing and managing risks from cybersecurity threats.
−Removed: The IS team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants.
+Added: Our Cybersecurity team, led by one of our Vice Presidents who also serves as our CISO, is responsible for assessing and managing risks from cybersecurity threats.
+Added: The Cybersecurity team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity consultants.
Our CISO has over 20 years of experience in the cybersecurity industry and has been instrumental in building several key security technologies, viz.
1 unchanged sentence
Previously, our CISO served in senior executive and technical leadership roles in several security companies.
−Removed: In addition, our CISO has experience as a pen-tester and has in-depth knowledge of operating system, networking and security products.
+Added: In addition, our CISO has experience as a pen-tester and has in-depth knowledge of operating systems, networking and security products.
Our CISO holds a bachelor’s degree in computer science and a master’s degree in software systems.
5 unchanged sentences
However, as indicated above, we cannot guarantee that our efforts will prevent any cybersecurity incident from occurring.
−Removed: As part of our IT security program, our Cybersecurity Executive Committee and Information Security Steering Committee meet throughout the year to monitor and assess information security risks.
+Added: As part of our Cybersecurity program, our Cybersecurity Executive Committee and Information Security Steering Committee meet throughout the year to monitor and assess information security risks.
In addition, we perform an enterprise risk assessment that is reviewed by the Committee and our Board of Directors on an annual basis and monitored on a quarterly basis by the Committee.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.