3 unchanged sentences
The Company has established an information security program and related processes for assessing, identifying, and managing material risks from cybersecurity threats to the Company, including governance at the executive and Board level of the Company’s cyber risk management strategy and the controls designed to protect its operations.
−Removed: The Company’s information security program is established at the executive level, with regular reporting to, and oversight by, the Company’s Board of Directors (the “Board”) as described below.
−Removed: At the highest level, the Company’s program includes multi-layered governance by management, the Audit and Finance Committee of the Board and the Board, as described in greater detail below.
+Added: The Company’s information security program is managed at the executive level, with regular reporting to, and oversight by, the Board as described below.
+Added: The Company’s program includes multi-layered governance by management, the Audit and Finance Committee of the Board and the Board, as described in greater detail below.
The Company’s policies and procedures identify how cybersecurity measures and controls are developed, implemented, and regularly reviewed and updated.
−Removed: The Company implements and maintains a set of controls to manage information risk, establishes guidelines for the use of information technology, and defines standards for identifying and mitigating information risks, considering controls from multiple security frameworks, such as the Center for Internet Security’s Critical Security Control and the Payment Card Industry Data Security Standard.
+Added: The Company implements and maintains a set of controls to manage information risk, establishes guidelines for the use of information technology, and defines standards for identifying and mitigating information risks.
+Added: The controls are developed based on risk assessments and a review of controls from multiple security frameworks, such as the Center for Internet Security’s Critical Security Control and the Payment Card Industry Data Security Standard.
The Company, internally and through third parties, conducts multiple information risk assessments each year.
−Removed: Risks identified in such assessments are considered for inclusion in the Company’s information risk portfolio and are then prioritized and addressed where appropriate through the Company’s broader information security programs.
−Removed: Assessments along with risk-based analysis and judgment are used by the Company to determine what the Company believes to be the optimal way to manage these risks.
+Added: Risks identified in such assessments are considered and evaluated for inclusion in the Company’s information risk portfolio and are then prioritized and addressed where appropriate to update the Company’s information security programs.
+Added: Assessments, along with risk-based analysis and judgment, are used by the Company to determine how it should manage these risks.
In addition, the Company’s Incident Response Plan (“IRP”) provides an outline for the Company on how to identify and address a significant cybersecurity incident.
5 unchanged sentences
The Company’s management holds annual executive data incident tabletop exercises and the information security team holds more frequent technical tabletop exercises.
−Removed: The Company leverages third-party security firms in different capacities to implement or operate various aspects of the Company’s information security program, including to conduct risk assessments and penetration testing.
−Removed: The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, such as conducting risk assessments of third-party vendors where the Company has determined it to be appropriate.
+Added: The Company leverages third-party security firms in different capacities to implement or operate various aspects of the Company’s information assets and information security program, including to conduct risk assessments and penetration testing.
+Added: The Company uses a variety of processes to address cybersecurity threats associated with third parties, including our use of third-party technology and services, such as conducting risk assessments and reviewing contractual requirements where the Company has determined it to be appropriate.
The Company (or the third parties on which it relies) may not be able to fully, continuously, and effectively implement security controls as intended.
5 unchanged sentences
Responsibility for risk oversight and management generally lies with the Company’s Board.
−Removed: To effectively manage oversight of our cybersecurity risk management practices, since 2019 the Board has delegated such responsibility to the Company’s Audit and Finance Committee.
+Added: To manage oversight of our cybersecurity risk management practices, since 2019 the Board has delegated such responsibility to the Company’s Audit and Finance Committee.
The Company’s Chief Information Security Officer (“CISO”) and the Information Security team provide reports to either the Audit and Finance Committee or the Board on a quarterly basis on various matters, such as current and emerging cybersecurity risks to the Company, risks and incidents that were escalated to management during the prior quarter (including those that did not require immediate escalation to the Audit and Finance Committee and/or full Board), internal and external assessments of the Company’s information security program, and a roadmap of projects and major initiatives to manage its information security posture.
−Removed: At the executive and management level, the CISO has primary responsibility for the architecture, implementation, and management of the Company’s information security program.
−Removed: The CISO has approximately two decades of experience in technology risk management, including over a decade with the Company, and has passed examinations and received certifications as a SANS Global Information Security Leader and a Certified Information Systems Auditor.
−Removed: The CISO reports
Abercrombie & Fitch Co.
2024 Form 10-K
−Removed: directly to the Company’s Chief Digital and Technology Officer.
+Added: At the executive and management level, the CISO has primary responsibility for the architecture, implementation, and management of the Company’s information security program .
+Added: The CISO has approximately two decades of experience in technology risk management, including over a decade with the Company, and has passed examinations and received certifications as a SANS Global Information Security Leader and a Certified Information Systems Auditor.
+Added: The CISO reports directly to the Company’s Chief Digital and Technology Officer.
The Company’s Information Security team, under the direction of the CISO, implements and provides governance and functional oversight for cybersecurity controls and services.
2 unchanged sentences
Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future and we continue to closely monitor cyber risk.
+Added: See “ ITEM 1A.
RISK FACTORS ” for additional information regarding the Company’s cybersecurity risks and which should be read in conjunction with this Item 1C.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.