4 unchanged sentences
Our cybersecurity risk management program is integrated into our Enterprise Risk Management framework and utilizes a holistic approach to addressing cybersecurity risk.
−Removed: It is supported by our employees, cybersecurity team, senior management, the Enterprise Risk Management committee, and our Board of Directors (Board).
+Added: It is supported by our employees, cybersecurity team, senior management, the Enterprise Risk Management committee, and our Board.
The underlying controls for the cybersecurity risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology and the Center for Internet Security Benchmark.
Our cybersecurity risk management program includes an incident response plan for evaluation, response and reporting of cybersecurity incidents, including notification of the Board and third parties , as appropriate.
−Removed: Under the plan, a Cybersecurity
−Removed: Intake Team, which is comprised of the Chief Information Officer (CIO), Senior Director of Information Security (SDIS) and other executive management, is responsible for a materiality assessment of cybersecurity incidents, taking into consideration both quantitative and qualitative factors, and subject to ongoing monitoring and escalation based on materiality.
+Added: Under the plan, a Cybersecurity Intake Team, which is comprised of the Chief Information Officer (CIO), Vice President of Infrastructure, Security, and Operations (VP of ISO), Senior Director of Information Security (SDIS) and other executive management, is responsible for a materiality assessment of cybersecurity incidents, taking into consideration both quantitative and qualitative factors, and subject to ongoing monitoring and escalation based on materiality.
Third party vendors and suppliers also play a role in our cybersecurity risk management program.
11 unchanged sentences
Within our organization, our CIO , who reports to our CEO , oversees cybersecurity.
−Removed: Our SDIS reports to our CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our network and systems, including the development and management of policies and processes to identify, contain, and investigate potential incidents and ensure recovery therefrom.
+Added: The VP of ISO and the SDIS, reporting to the CIO, are generally responsible for management of cybersecurity risk and the protection and defense of our network and systems, including the development and management of policies and processes to identify, contain, and investigate potential incidents and ensure recovery therefrom.
Our SDIS has over 15 years of experience managing information technology and cybersecurity matters in multiple industries.
2 unchanged sentences
Our Board oversees our cybersecurity risk management program, and includes cybersecurity as part of the assessment of the Company's overall Enterprise Risk Management program.
−Removed: At least twice per year, and more frequently, if necessary, our CIO updates our Board on the Company's cyber risk profile and the steps taken by management to mitigate those risks.
−Removed: In the event of a material cybersecurity incident, the Board would receive prompt and timely information regarding the incident, as well as ongoing updates regarding such incident until it has been addressed.
−Removed: Cybersecurity-related risks are included in the Enterprise Risk Management committee’s evaluation of top risks to the enterprise, which are also presented to the Board and executive management twice per year.
+Added: At least annually, our CIO updates our Board on the Company's cyber risk profile and the steps taken by management to mitigate those risks.
+Added: In the event of a material cybersecurity incident, the reporting system is designed to provide the Board with prompt and timely information regarding the incident, as well as ongoing updates regarding such incident until it has been addressed.
+Added: Cybersecurity-related risks are included in the Enterprise
+Added: Risk Management Committee’s evaluation of top risks to the enterprise, which are also presented to the Board and executive management twice per year.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.