Unresolved Staff Comments
−Removed: Table Archrock, Contents
Cybersecurity
1 unchanged sentence
We utilize technology in all aspects of our business to drive operational efficiencies and enhance our value proposition to our customers.
−Removed: Our investments have focused on implementing cloud-based solutions to replace legacy systems, the automation of workflows, integration of digital and mobile tools for our field service technicians and expanded remote monitoring capabilities of our compressor fleets.
+Added: Our investments have focused on implementing cloud-based solutions to replace legacy systems, the automation of workflows, integration of digital and mobile tools for our field service technicians and expanded remote monitoring capabilities of our compression fleet.
We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
16 unchanged sentences
Cybersecurity awareness and education is further emphasized through a company-wide education campaign during National Cybersecurity Awareness Month.
−Removed: Table Archrock, Contents
Independent Third-Party Assessment
−Removed: To complement our existing enterprise risk management program, in 2022, we engaged a third party to assist in the development and implementation of a business continuity plan that includes our planned response procedures in the event of a critical system outage or operational disruption.
−Removed: We maintain cybersecurity procedures covering crisis management, emergency response and incident communication.
−Removed: During 2023, we engaged an independent third-party specialist to assist in deployment of foundational systems to help position Archrock for future advancement in cybersecurity tooling, including the implementation of multi-factor authentication to enhance user access security and application protection.
−Removed: In addition, our IT team monitors ratings applied to our security environment by outside firms and responds accordingly.
+Added: As part of our cybersecurity strategy, we engage third-party firms to perform assessments , including detailed penetration testing, to identify potential vulnerabilities and evaluate the effectiveness of our security controls.
+Added: In addition, we maintain a Business Continuity and Incident Response Plan, which is validated through tabletop exercises to support our readiness to respond to cybersecurity events.
Third-Party Risk Oversight
2 unchanged sentences
After engagement, our third-party management solution provides a repeatable measure of security performance based on external security indicators, including monitoring changes to vendor cybersecurity risk scores and identification of new cybersecurity risks.
−Removed: Key vendor cybersecurity risk scores are included in our cybersecurity risk report provided to executive leadership on a quarterly basis.
+Added: Key vendor cybersecurity risk scores are included in our cybersecurity risk report provided to executive leadership when there is a noticeable change in the vendor’s cybersecurity risk score.
These visibility, insights, and processes help us to manage vendor risks.
+Added: Risk Management with Respect to Information Technology and Cybersecurity
Our Board of Directors has an active role, as a whole and through its subcommittees, in oversight of our risks and is assisted by management in the exercise of these responsibilities.
Our Board of Directors delegates oversight to specific subcommittees and is informed quarterly through committee reports.
−Removed: It is our practice that all board members are invited to committee meetings, and they typically attend these meetings.
−Removed: The Audit Committee of our Board of Directors is responsible for overseeing our cybersecurity risk management program.
+Added: The Audit Committee is responsible for overseeing our cybersecurity risk management program.
Various Audit Committee members have first-hand or supervisory experience over cybersecurity, and our Audit Committee chair is certified in the National Association of Corporate Directors Cyber Risk Oversight Program.
−Removed: Our IT senior management team, including our Vice President of IT, is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program, including supervising both our internal cybersecurity personnel and external cybersecurity consultants.
−Removed: Our Vice President of IT has over 29 years of experience managing enterprise applications, a majority of this time in a global environment adhering to General Data Protection Regulation compliance and other regulations.
−Removed: Additional experience includes managing large scale technology transformations involving applications, infrastructure and security.
−Removed: Our IT senior management has more than a decade of experience in cybersecurity risk management, including CISSP certification.
+Added: Our Vice President of IT is a member of our senior IT management team and is primarily responsible for assessing and managing our material risks from cybersecurity threats.
+Added: Our Vice President of IT has primary responsibility for our overall cybersecurity risk management program, including supervising both our internal cybersecurity personnel and external cybersecurity consultants.
+Added: Our Vice President of IT has over 25 years of experience primarily focused on managing large scale, complex programs and projects as well as managing application development teams in a global environment.
+Added: Our senior manager in charge of IT security has more than a decade of experience in cybersecurity risk management, including CISSP certification.
Our IT management team utilizes various processes and technologies to identify, protect, detect, respond, and recover from cybersecurity events and incidents.
−Removed: Cybersecurity events and incidents can be reported to our Vice President of IT in several ways, including through our external managed detection and response provider, system alerts, or employees reporting suspicious activity.
−Removed: The Vice President of IT reports to our executive leadership team, who provides cybersecurity risk assessment and response updates to the Audit Committee on a regular basis, or as often as deemed necessary.
−Removed: Table Archrock, Contents
+Added: During 2024, our IT management team initiated an independent evaluation of our cybersecurity framework and implemented certain company-wide security enhancements.
+Added: In addition, the IT management team is subject to specific key performance indicators and performance against such key performance indicators is reviewed by our Audit Committee.
+Added: To create awareness in our first line of defense, training is also provided to employees to help them identify security risks, which includes routine phishing exercises and appraisal of and assistance with security-related performance.
+Added: Cybersecurity events and incidents can be reported to our IT management team in several ways, including through our externally managed detection and response provider, system alerts, or employees reporting suspicious activity.
+Added: The Vice President of IT reports to our executive leadership team and along with our senior manager in charge of IT security, provides cybersecurity risk assessment and response updates to the Audit Committee on a regular basis, or as often as deemed necessary .
+Added: Other Areas of Risk Management
+Added: See our 2023 Sustainability Report at www.archrock.com for information associated with additional areas of risk management addressed by our management team and reviewed by our Board of Directors and committees of our Board of Directors.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.