5 unchanged sentences
Cybersecurity risk is closely monitored by our executive leadership with governance and oversight by the Audit Committee of the Board, whose oversight is expressly noted in its chartered responsibilities along with broader enterprise risk management.
−Removed: A cybersecurity team, led by the General Counsel, the Chief Information Officer (“CIO”) and the Chief Information Security Officer (“CISO”), is responsible for the management, implementation and operation of the cybersecurity program, alongside qualified internal and external security and IT subject matter experts .
−Removed: Our CIO leads the Company’s information technology organization and brings over 25 years of experience to the role.
−Removed: She joined AdvanSix as Senior Director, Information Technology in September 2016, and prior to that time, spent 17 years with Honeywell, where she held IT positions of increasing responsibility in the Transportation Systems business and Corporate functions.
−Removed: Before joining Honeywell, our CIO held several roles at Electronic Data Systems (EDS), including system design and development, configuration management and database administration.
−Removed: She earned a Bachelor’s Degree in Psychology and an MBA, in Supply Chain and Business Information Systems, from Michigan State University.
−Removed: Our CISO leads the Company’s cybersecurity and IT infrastructure organization and brings over 19 years of experience in the areas of technology governance, risk and compliance management, information security and cybersecurity, risk assessments, secure-Software Development Life Cycle (SDLC), security architecting, cloud security design and operations, threat and vulnerability management, Security Information and Event Management (SIEM)/Security Operation Center (SOC), and incident response management.
+Added: A cybersecurity team, led by the General Counsel, the Chief Digital and Information Officer (“CDIO”) and the Chief Information Security Officer (“CISO”), is responsible for the management, implementation and operation of the cybersecurity program, alongside qualified internal and external security and IT subject matter experts .
+Added: Our CDIO leads the Company’s digital transformation and technology team and brings 20 years of experience to the role.
+Added: He joined AdvanSix as Vice President and CDIO in August 2025, and prior to that time, he held various leadership positions in the energy and manufacturing sector, including GE, Baker Hughes, TechnipFMC and Civitas Resources.
+Added: He earned a Bachelor’s and Master's degree in Computer Science and Engineering and is a graduate of Texas Tech University.
+Added: Our CISO leads the Company’s core enterprise services team, including cybersecurity, and brings over 20 years of experience in the areas of technology governance, risk and compliance management, information security and cybersecurity, risk assessments, secure-Software Development Life Cycle (SDLC), security architecting, cloud security design and operations, threat and vulnerability management, Security Information and Event Management (SIEM)/Security Operation Center (SOC), and incident response management.
He joined AdvanSix in December 2018 as our Cybersecurity Leader, and prior to that time, he worked as VP and Information Security Officer at MUFG, managing the overall risk management program, design and implementation.
2 unchanged sentences
In order to stay current with best practices, our CISO regularly completes cybersecurity certification courses and attends industry conferences.
−Removed: We track the effectiveness of our cybersecurity program using key performance and risk metrics through daily surveillance with dashboard updates provided by the CISO to the General Counsel and the CIO supplemented by regular updates to the senior leadership team, which includes the Chief Executive Officer and the Chief Financial Officer .
+Added: Our General Counsel brings over 20 years of experience managing and assessing enterprise risks through both his tenure at the Company since 2016, which has included the assessment of risks arising from cybersecurity threats, and his prior experience as outside counsel to publicly traded companies.
+Added: We track the effectiveness of our cybersecurity program using key performance and risk metrics through daily surveillance with dashboard updates provided by the CISO to the General Counsel and the CDIO supplemented by regular updates to the senior leadership team, which includes the Chief Executive Officer and the Chief Financial Officer .
In addition, the CISO provides cybersecurity updates to the Audit Committee and the full Board.
1 unchanged sentence
At least annually, the full Board is provided an update which includes a review of governance oversight, cybersecurity controls, implemented improvements and mitigations, vulnerability risks, third-party vendors utilized, and status of key initiatives.
−Removed: AdvanSix’s cybersecurity program is based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and consists of technical, administrative and operational controls working together as an integrated solution.
+Added: AdvanSix’s cybersecurity program is based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework and zero-trust principles, and consists of technical, administrative and operational controls working together as an integrated solution.
AdvanSix engaged the services of a best-in-class third party cybersecurity firm to conduct an independent comprehensive maturity assessment of our cyber security program across critical areas which align with the NIST Cybersecurity Framework.
4 unchanged sentences
We continue to assess evolving threats and update our policies and procedures appropriately .
−Removed: Our cybersecurity program is designed to protect information technology networks and assets using the latest technologies that leverage artificial intelligence, machine learning and automation.
+Added: Our cybersecurity program is designed to protect information technology networks and assets using the zero-trust principles, latest technologies that leverage artificial intelligence, machine learning and automation.
Our security architecture uses a “defense-in-depth approach,” with controls implemented at user, email, endpoint, cloud, access, and network levels.
1 unchanged sentence
Our comprehensive security awareness and training program covers 100% of our employees on protective measures regarding information security, data privacy, cyber-attacks and recognizing phishing attempts.
−Removed: This program includes regular communication, interactive trainings, and simulated phishing assessments and is designed to reinforce risk awareness and address the latest and most relevant risks.
+Added: This program includes regular communication, interactive trainings, and simulated phishing assessments and is designed to reinforce risk
+Added: awareness and address the latest and most relevant risks.
We have implemented robust controls and procedures to ensure trainings are completed in a timely manner and to track our cybersecurity performance metrics.
+Added: We seek to identify and address cybersecurity threats and risks that can arise from our use of third parties, including those that comprise our information systems, supply chain operations or who have access to certain data.
+Added: We utilize supplier risk management practices, including enhanced due diligence assessments, that seek to identify cybersecurity risks associated with our use of third-party providers and the scope and nature of their work with us.
+Added: These risks are assessed and prioritized based on, among other things, supplier assessments, threat intelligence, and industry practices.
+Added: We consider these risks at the time of supplier onboarding and endeavor to assess changes in risk throughout the lifecycle of our relationship with suppliers.
Our environment is monitored continuously for security events by our security operations center, which detects, alerts, and responds to any potential security incidents on 24/7 basis.
−Removed: Escalations of potential incidents or notable risks are escalated by the cybersecurity team and the CISO to the General Counsel and the CIO.
−Removed: If appropriate, the status of such potential incidents or notable risks will be further escalated to the Chief Executive Officer and the Chief Financial Officer.
+Added: Escalations of potential incidents or notable risks are escalated by the cybersecurity team and the CISO to the General Counsel and the CDIO.
+Added: If appropriate, the status of such potential incidents or notable risks will be further escalated to the Chief Executive Officer, the Chief Financial Officer and the Board.
As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company.
7 unchanged sentences
We also engage independent third parties to perform security assessments on at least an annual basis, which include penetration testing of our external and internal environment.
−Removed: In summary, the Company’s approach to cybersecurity is intended to assess, identify, and manage risks from cybersecurity threats, implement mitigations and controls consistent with the NIST Cybersecurity Framework and support safe, stable and sustainable operations, while protecting our intellectual property, confidential information, privacy data, operations, and infrastructure.
+Added: In summary, the Company’s approach to cybersecurity is intended to assess, identify, and manage risks from cybersecurity threats, implement mitigations and controls consistent with the NIST Cybersecurity Framework and zero-trust approach, and support safe, stable and sustainable operations, while protecting our intellectual property, confidential information, privacy data, operations, and infrastructure.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.