5 unchanged sentences
The Company’s program includes multi-layered governance by management, the Audit and Finance Committee of the Board and the Board, as described in greater detail below.
−Removed: The Company’s policies and procedures identify how cybersecurity measures and controls are developed, implemented, and regularly reviewed and updated.
−Removed: The Company implements and maintains a set of controls to manage information risk, establishes guidelines for the use of information technology, and defines standards for identifying and mitigating information risks.
+Added: The Company’s policies and procedures identify how cybersecurity measures and controls are developed, implemented, reviewed, and updated.
+Added: The Company implements and maintains a set of controls to manage information risk, establish guidelines for the use of information technology, and define standards for identifying and mitigating information risks.
The controls are developed based on risk assessments and a review of controls from multiple security frameworks, such as the Center for Internet Security’s Critical Security Control and the Payment Card Industry Data Security Standard.
The Company, internally and through third parties, conducts multiple information risk assessments each year.
−Removed: Risks identified in such assessments are considered and evaluated for inclusion in the Company’s information risk portfolio and are then prioritized and addressed where appropriate to update the Company’s information security programs.
+Added: Risks identified in such assessments are considered, evaluated, and are then prioritized and addressed where appropriate to update the Company’s information security programs.
Assessments, along with risk-based analysis and judgment, are used by the Company to determine how it should manage these risks.
7 unchanged sentences
The Company leverages third-party security firms in different capacities to implement or operate various aspects of the Company’s information assets and information security program, including to conduct risk assessments and penetration testing.
−Removed: The Company uses a variety of processes to address cybersecurity threats associated with third parties, including our use of third-party technology and services, such as conducting risk assessments and reviewing contractual requirements where the Company has determined it to be appropriate.
+Added: The Company uses a variety of processes to address cybersecurity threats associated with third parties, including our use of third-party technology and services, such as risk assessments and contractual agreement review where the Company has determined it to be appropriate.
The Company (or the third parties on which it relies) may not be able to fully, continuously, and effectively implement security controls as intended.
19 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.