13 unchanged sentences
There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.
−Removed: We utilize the CIS CSC to promote best practices and reduce the risk of a successful cybersecurity attack.
−Removed: This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CIS CSC as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
+Added: In executing and assessing our program, we reference National Standards that emphasize identifying and managing risks, protecting critical assets, detecting potential threats, and responding to and recovering from incidents.
+Added: This helps guide our ongoing efforts to safeguard information systems, maintain business continuity, and reduce cyber risk across the enterprise.
+Added: This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the National Standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Enterprise Risk Management Process Integration
9 unchanged sentences
Third-Party Risk Oversight
−Removed: We utilize a third-party risk management solution to monitor key vendors .
−Removed: Prior to engagement, we conduct initial risk assessments of our vendors based on security questionnaire responses and open-source intelligence gathering.
−Removed: After engagement, our third-party management solution provides a repeatable measure of security performance based on external security indicators, including monitoring changes to vendor cybersecurity risk scores and identification of new cybersecurity risks.
−Removed: Key vendor cybersecurity risk scores are included in our cybersecurity risk report provided to executive leadership when there is a noticeable change in the vendor’s cybersecurity risk score.
+Added: Based on our analysis of each third-party provider’s criticality to our operations and respective risk profile, our oversight processes may include , among other things, pre-engagement risk assessments through security questionnaire responses and open-source intelligence gathering, negotiated contractual provisions where possible and post-engagement monitoring of external security indicators, through a third-party solution that tracks changes to vendor cybersecurity risk scores and identifies new cybersecurity risks.
+Added: Executive leadership is kept updated on significant changes to a critical vendor’s cybersecurity risk score.
These visibility, insights, and processes help us to manage vendor risks.
2 unchanged sentences
Our Board of Directors delegates oversight to specific subcommittees and is informed quarterly through committee reports.
−Removed: The Audit Committee is responsible for overseeing our cybersecurity risk management program.
+Added: The Audit Committee reports to the Board of Directors regarding its activities, including those related to cybersecurity, as the Audit Committee is responsible for overseeing our cybersecurity risk management program.
Various Audit Committee members have first-hand or supervisory experience over cybersecurity, and our Audit Committee chair is certified in the National Association of Corporate Directors Cyber Risk Oversight Program.
2 unchanged sentences
Our Vice President of IT has over 25 years of experience primarily focused on managing large scale, complex programs and projects as well as managing application development teams in a global environment.
−Removed: Our senior manager in charge of IT security has more than a decade of experience in cybersecurity risk management, including CISSP certification.
+Added: Our senior manager in charge of IT security has more than a decade of experience in cybersecurity risk management, including CISSP and C|CISO certifications.
Our IT management team utilizes various processes and technologies to identify, protect, detect, respond, and recover from cybersecurity events and incidents.
−Removed: During 2024, our IT management team initiated an independent evaluation of our cybersecurity framework and implemented certain company-wide security enhancements.
In addition, the IT management team is subject to specific key performance indicators and performance against such key performance indicators is reviewed by our Audit Committee.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.