10 unchanged sentences
Cybersecurity is a standing agenda item of the Audit Committee’s regular quarterly meetings, where the Audit Committee reviews and discusses cybersecurity risks along with the Company’s cybersecurity programs and strategy with management.
−Removed: The Audit Committee receives reports and presentations from our Chief Information Officer (CIO) and our General Counsel at its quarterly meetings on a range of topics, including our cybersecurity program and processes, our information systems, risk identification and mitigation strategies, the evolving cybersecurity threat landscape, regulatory developments, board education, and notable incidents or threats affecting the Company.
−Removed: From time to time between quarterly meetings, our CIO and General Counsel or other members of management may hold additional cybersecurity-related discussions with the Audit Committee.
+Added: The Audit Committee receives reports and presentations from our Chief Information Officer (CIO) and our Chief Legal Officer (CLO) at its quarterly meetings on a range of topics, including our cybersecurity program and processes, our information systems, risk identification and mitigation strategies, the evolving cybersecurity threat landscape, regulatory developments, board education, and notable incidents or threats affecting the Company.
+Added: From time to time between quarterly meetings, our CIO and CLO or other members of management may hold additional cybersecurity-related discussions with the Audit Committee.
The Audit Committee regularly reports on its cybersecurity program oversight to the Board of Directors.
5 unchanged sentences
Our CIO, Security Director, and cybersecurity team also work closely with our legal team on various aspects of our cybersecurity program.
−Removed: We also periodically engage assessors, consultants, Payment Card Industry-Data Security Standards (PCI-DSS) auditors, or other third parties to assist with our cybersecurity program.
−Removed: When appropriate, we engage forensic investigators and legal counsel to investigate cybersecurity threats and incidents.
−Removed: Our Cyber Security Committee is a management committee chartered to oversee our cybersecurity program.
+Added: Our Cyber Security Committee, which is chaired by the CIO, and includes the CLO, the Chief Administrative Officer, and the Security Director among other team members, is a management committee chartered to oversee our cybersecurity program.
The Cyber Security Committee meets at least quarterly and more frequently as appropriate to review and discuss the Company’s cybersecurity program.
16 unchanged sentences
We also use third-party managed security services to augment our cybersecurity team’s capabilities.
−Removed: We have adopted a Cyber Security Incident Response Plan (the “CSIRP”) to provide a standardized framework for responding to cybersecurity incidents.
+Added: We have adopted and maintain a Cyber Security Incident Response Plan (the “CSIRP”) to provide a standardized framework for responding to cybersecurity incidents.
The CSIRP is a coordinated approach to investigate, contain, mitigate, and document cybersecurity incidents, including reporting and escalating findings as appropriate (including to the crisis management team).
−Removed: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term.
−Removed: However, due to evolving cybersecurity threats, despite our security measures, we may not able to anticipate, prevent, and stop future cybersecurity incidents, including attacks to our information systems and data and those of our partners.
+Added: We also periodically engage external assessors, consultants, Payment Card Industry-Data Security Standards (PCI-DSS) auditors, or other third parties to assist with our cybersecurity program.
+Added: When appropriate, we engage forensic investigators and legal counsel to investigate cybersecurity threats and incidents.
+Added: Based on the information available to us as of the date of this Annual Report, we believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and as of the date of this Annual Report, we are not aware of any material risks from cybersecurity threats that are reasonably likely to do so.
+Added: However, we cannot eliminate all risks from cybersecurity threats or provide assurances that the Company will not be materially affected by such risks in the future.
+Added: Due to evolving cybersecurity threats, despite our security measures, we may not able to anticipate, prevent, and stop future cybersecurity incidents, including attacks to our information systems and data and those of our partners.
Additional information on cybersecurity risks we face is discussed in Item 1A of Part I, “Risk Factors”, which should be read in conjunction with the foregoing.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.