5 unchanged sentences
Risks from cybersecurity threats are regularly evaluated as a part of our broader risk management activities and as a fundamental component of our internal control system.
−Removed: Our information technology, or IT, program is led by our Director of Information Technology, who strives to monitor and mitigate risks from cybersecurity threats and provides reporting to the Audit Committee.
+Added: Our information technology program is led by our Director of Information Technology, who strives to monitor and mitigate risks from cybersecurity threats and provides reporting to the Audit Committee.
Our approach to cybersecurity is not a one-time effort but an ongoing process.
1 unchanged sentence
We address cybersecurity challenges and enhance our overall risk management efforts by adopting and working to integrate recognized best practices, standards, and controls utilizing guidelines from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) for our protection and prevention of cybersecurity, risk management, data backup, and disaster recovery.
−Removed: Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program, (ii) outsourced information technology firm and consultants with significant expertise in cybersecurity (iii) an incident response team comprised of a cross-section of management with oversight over our programs, (iv) incident detection and response policies, and (v) ongoing security awareness training programs for all employees.
+Added: Our cybersecurity program includes some key aspects such as (i) a Cybersecurity Leader who oversees our day-to-day program, (ii) outsourced information technology firm and consultants with significant expertise in cybersecurity (iii) an incident response team comprised of a cross-section of management with oversight over our programs, (iv) incident detection and response policies, (v) ongoing security awareness training programs for all employees, and (vi) a dedicated security administrator position to oversee any alerts or suspicious activity reported across the enterprise.
We maintain a practical approach to cybersecurity.
13 unchanged sentences
Prioritizing and addressing risks through our dedicated cybersecurity risk management program and cybersecurity council;
+Added: • Periodic education and testing of our employees via targeting phishing simulations, monthly optional cybersecurity training courses, and a variety of digital and print signage;
• Annual Third-Party SOC Reviews:
11 unchanged sentences
The incident response team is composed of various stakeholders from all necessary aspects of the business, and the plan includes the steps to follow and communications necessary if/when a cybersecurity event occurs.
−Removed: The individual incident response team members represent expertise in IT, cybersecurity, finance, and operations that has been obtained generally from a combination of education and awareness, including relevant degrees and/or certifications, and work experience.
−Removed: The Director of IT has served in various roles in information technology and information security for 30 years, including serving in technical management and leadership positions in multiple verticals.
+Added: The individual incident response team members represent expertise in IT, cybersecurity, public/investor relations, finance, and operations that has been obtained generally from a combination of education and awareness, including relevant degrees and/or certifications, and work experience.
+Added: The Director of IT has served in various roles in information technology and information security for over 30 years, including serving in technical management and leadership positions in multiple verticals.
The Director of IT holds undergraduate and graduate degrees in computer science and has attained several recognized network and security certifications throughout their career.
2 unchanged sentences
When a cybersecurity incident is detected, we conduct an immediate assessment, determine materiality, and take appropriate actions as described above.
−Removed: This process is also followed when we are notified that a supplier has a cybersecurity incident.
+Added: This process is also followed when we are notified
+Added: that a supplier has a cybersecurity incident.
As noted above, the Audit Committee regularly receives reports on cybersecurity matters from senior IT leadership.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.