3 unchanged sentences
We recognize the critical importance of maintaining the confidentiality, integrity and availability of our information systems and data, and of effectively assessing, identifying and managing cybersecurity and related risks.
−Removed: Our cybersecurity risk management program is integrated into our Enterprise Risk Management framework and utilizes a holistic approach to addressing cybersecurity risk, and it is supported by our employees, cybersecurity team, senior management, the Enterprise Risk Management committee (a committee comprised of primary corporate functions) and our Board of Directors.
−Removed: The underlying controls for the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology (NIST) and the Center for Internet Security Benchmark (CIS).
−Removed: Our cyber risk management program includes an incident response plan for evaluation, response and reporting of cybersecurity incidents, including notification of the Board and third parties, as appropriate.
−Removed: Under the plan, a Cybersecurity Intake Team (CIT), which is comprised of the Chief Information Officer (CIO), Senior Director of Information Security (SDIS) and other executive management, is responsible for a materiality assessment of cybersecurity incidents, taking into consideration both quantitative and qualitative factors, and subject to ongoing monitoring and escalation based on materiality.
−Removed: Third party vendors and suppliers also play a role in our cyber risk management program.
+Added: Our cybersecurity risk management program is integrated into our Enterprise Risk Management framework and utilizes a holistic approach to addressing cybersecurity risk.
+Added: It is supported by our employees, cybersecurity team, senior management, the Enterprise Risk Management committee, and our Board of Directors (Board).
+Added: The underlying controls for the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology and the Center for Internet Security Benchmark.
+Added: Our cybersecurity risk management program includes an incident response plan for evaluation, response and reporting of cybersecurity incidents, including notification of the Board and third parties , as appropriate.
+Added: Under the plan, a Cybersecurity
+Added: Intake Team, which is comprised of the Chief Information Officer (CIO), Senior Director of Information Security (SDIS) and other executive management, is responsible for a materiality assessment of cybersecurity incidents, taking into consideration both quantitative and qualitative factors, and subject to ongoing monitoring and escalation based on materiality.
+Added: Third party vendors and suppliers also play a role in our cybersecurity risk management program.
In circumstances where such third parties will access our systems and data, our SDIS participates in the vendor management process, including the review of contractual requirements and contractually imposing obligations on the vendor to report cybersecurity incidents to us so that we can assess the impact.
−Removed: In addition to the incident response plan and vendor management process, our cyber risk management program includes:
+Added: In addition to the incident response plan and vendor management process, our cybersecurity risk management program includes:
• an information technology and cybersecurity training program, and ongoing employee testing to evaluate the effectiveness of quarterly internal training and awareness communications;
2 unchanged sentences
• crisis management, business continuity, and disaster recovery plans.
−Removed: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have had a material adverse effect on our operations or financial standing.
+Added: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have had a material adverse effect or are reasonably likely to have a material effect on our business strategy, operations or financial condition.
Notwithstanding the efforts we take to manage our cybersecurity risk, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.
2 unchanged sentences
Management's Role in Managing Risk
−Removed: Within our organization, our CIO, who reports to our CEO, oversees our cybersecurity function.
+Added: Within our organization, our CIO , who reports to our CEO , oversees cybersecurity.
Our SDIS reports to our CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our network and systems, including the development and management of policies and processes to identify, contain, and investigate potential incidents and ensure recovery therefrom.
Our SDIS has over 15 years of experience managing information technology and cybersecurity matters in multiple industries.
−Removed: The SDIS maintains Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications and holds a degree in information technology management.
+Added: The SDIS maintains Certified Information Systems Security Professional and Certified Information Security Manager certifications and holds a degree in information technology management.
Board's Role in Oversight
−Removed: Our full Board oversees our cyber risk management program, and includes cybersecurity as part of the assessment of the Company's overall Enterprise Risk Management program.
+Added: Our Board oversees our cybersecurity risk management program, and includes cybersecurity as part of the assessment of the Company's overall Enterprise Risk Management program.
At least twice per year, and more frequently, if necessary, our CIO updates our Board on the Company's cyber risk profile and the steps taken by management to mitigate those risks.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.