3 unchanged sentences
We have developed and implemented an information security and cybersecurity risk management program (“Program”) intended to protect and preserve the confidentiality, integrity and availability of our data and information technology systems.
−Removed: Our Program is integrated into our overall enterprise risk management program.
+Added: Our Program takes a risk-based approach and is integrated into our overall enterprise risk management program.
We use the National Institute of Standards and Technology Cybersecurity Framework (the “NIST CSF”) as a benchmark to ensure that our Program is maintained in line with industry best practices.
1 unchanged sentence
The Company maintains a decentralized information technology infrastructure, where each of our business units utilizes a separate and distinct information technology system.
−Removed: This means that if any business unit’s systems are compromised, there is significantly less risk that another business unit will be impacted by that event.
+Added: This means that if any business unit’s systems are compromised, there is less risk that another business unit will be impacted by that event.
This decentralized structure also allows our information security professionals embedded within an individual business unit to make quick, efficient decisions when changes or actions are needed and provides an additional safeguard for our data and systems.
Our Program includes:
−Removed: ● risk assessments and penetration tests integrated within our overall risk management processes that are designed to identify cybersecurity and technology risks, as well as to formulate management actions to respond to, mitigate and remediate material issues (if any);
−Removed: ● annual management reporting to the Board of Directors (the “Board”);
−Removed: ● reporting of the scope, objectives and results of internal audits on the procedures performed on the control environment related to our information security systems and security controls to the Audit Committee at least two times a year;
−Removed: ● annual cybersecurity awareness training to instruct employees how to better identify cybersecurity concerns and to avoid actions that might inadvertently allow outsiders to access our systems ;
−Removed: ● installation of end point protection software on our Company-managed systems and workstations in an effort to detect and prevent malicious code from impacting our systems ;
+Added: ● periodic risk assessments and penetration tests, which are integrated within our enterprise risk management framework processes, designed to identify cybersecurity and technology risks, as well as to formulate management actions to respond to, mitigate and remediate material issues (if any);
+Added: ● annual management reporting to the Board;
+Added: ● reporting of the scope, objectives and results of internal audits on the procedures performed to validate the effectiveness of our control environment related to our information security systems and security controls to the Audit Committee at least two times a year;
+Added: ● annual cybersecurity awareness training, including phishing simulation campaigns, to educate employees on recognizing cybersecurity threats and preventing actions that could unintentionally grant unauthorized access to our systems;
+Added: ● deployment of endpoint protection software, supported by external managed services, to attempt to proactively detect and block malicious code from affecting our systems;
● a cross-functional team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents;
−Removed: ● the use of external service providers, where appropriate, to assess, monitor, test or otherwise assist with aspects of our security controls and response to cybersecurity incidents;
+Added: ● the use of external service providers , where appropriate, to assess risk, monitor alerts, perform penetration testing or otherwise assist with aspects of our security controls and response to cybersecurity incidents;
● a documented framework and supporting processes for handling security incidents that facilitates coordination across multiple parts of the Company.
7 unchanged sentences
This update provides an overall assessment of the effectiveness of our Program and a review of areas of focus for the upcoming year.
−Removed: The Board also receives periodic reports from our Vice President, Internal Audit, on the audit focus areas and control testing related to our information security systems
−Removed: and security controls, and our management team updates the Board, as necessary, regarding any material cybersecurity incidents.
+Added: The Board also receives periodic reports from our Vice President, Internal Audit, on the audit focus areas and control testing related to our information security systems and security controls, and our management team updates the Board, as necessary, regarding any significant cybersecurity incidents.
Our management team, including our Senior Vice President and Chief Financial Officer, Senior Vice President and General Counsel, Vice President, Information Technology, and Vice President, Internal Audit , is responsible for assessing and managing our material risks from cybersecurity threats.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.