4 unchanged sentences
The CSTO and CISO meet on a quarterly basis with other members of Management as the Technology and Information Security Committee (“TIS Committee”) to review the Company’s cybersecurity risk management, business continuity planning and disaster recovery strategy and performance.
−Removed: The Company’s cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology (“NIST”), the International Organization for Standardization (“ISO”), applicable industry standards, and applicable data privacy and cybersecurity regulations.
+Added: The Company’s cybersecurity policies, standards, processes, and practices are generally based on recognized frameworks established by the National Institute of Standards and Technology (“NIST”), the International Organization for Standardization (“ISO”), applicable industry standards, and applicable data privacy and cybersecurity regulations.
Annual technology and cybersecurity risk assessments are conducted to identify and evaluate applicable risks and controls designed to address such risks.
3 unchanged sentences
• Identification and Reporting:
−Removed: The Company has controls and procedures designed to identify, assess, manage and respond to cybersecurity threats and incidents, including fulfilling potential public disclosure or reporting requirements as may be applicable.
+Added: The Company strives to have controls and procedures designed to identify, assess, manage and respond to cybersecurity threats and incidents, including fulfilling potential public disclosure or reporting requirements as may be applicable.
• Technical Safeguards:
−Removed: The Company implements and maintains technical safeguards designed to protect the Company’s information systems and data from cybersecurity threats, including perimeter and web application firewalls, proxy, intrusion prevention and detection systems, anti-malware, endpoint detection response functionality, data loss prevention systems, security incident event management, geo-blocking and access controls.
+Added: The Company strives to implement and maintain technical safeguards designed to protect the Company’s information systems and data from cybersecurity threats, including perimeter and web application firewalls, proxy, intrusion prevention and detection systems, anti-malware, endpoint detection response functionality, data loss prevention systems, security incident event management, geo-blocking and access controls.
Such safeguards are generally evaluated through internal security testing, third party penetration testing and vulnerability assessments, as well as outside audits and certifications, and revised as warranted.
1 unchanged sentence
• Education and Awareness:
−Removed: The Company provides periodic, mandatory training for all levels of employees regarding information security, cybersecurity threats, business continuity planning and disaster recovery to equip Company employees with tools to address cybersecurity threats, and to communicate the Company’s evolving information security policies, standards, processes and practices.
+Added: The Company provides periodic, mandatory training for all levels of employees regarding information security, cybersecurity threats, business continuity planning and disaster recovery in an effort to equip Company employees with tools to address cybersecurity threats, and to communicate the Company’s evolving information security policies, standards, processes and practices.
• Incident Response and Recovery Planning:
−Removed: The Company’s Security Operations Center (“SOC”), reporting to the CISO, provides 24x7 incident monitoring.
−Removed: If an incident occurs which SOC determines qualifies as a “critical risk” according to predetermined criteria, the SOC engages an incident management team to assist with evaluating, responding to and managing the response of the incident.
−Removed: The Company has established and maintains comprehensive incident identification, containment, response and business continuity plans designed to respond to potential cybersecurity incidents.
−Removed: The Company conducts periodic drills and tabletop exercises to test these.
+Added: The Company’s Security Operations Center (“SOC”), reporting to the CISO, strives to provide 24x7 incident monitoring.
+Added: If an incident occurs which SOC determines qualifies as a “critical risk” according to predetermined criteria, Company policy requires the SOC to engage an incident management team to assist with evaluating, responding to and managing the response of the incident.
+Added: The Company has established and seeks to maintain comprehensive incident identification, containment, response and business continuity plans designed to respond to potential cybersecurity incidents.
+Added: The Company strives to conduct periodic drills and tabletop exercises to test these.
• Third-Party Risk Management:
−Removed: The Company conducts initial, and on a periodic basis, subsequent risk evaluations of vendors that satisfy certain preestablished criteria classifying such vendors as presenting higher potential cybersecurity risks based upon vendor access to or provision of information systems or data to the Company that present significant potential risks.
−Removed: The Company conducts periodic assessments of the Company’s policies, standards, processes and practices.
+Added: The Company strives to conduct initial and periodic risk evaluations of vendors meeting predefined criteria for heightened cybersecurity risk, based on their access to or provision of critical information systems or data.
+Added: The Company strives to conduct periodic assessments of the Company’s policies, standards, processes and practices.
Summary results of such assessments are evaluated by the CISO to assist the Company in adjusting its cybersecurity policies, standards, processes and practices;
1 unchanged sentence
The Board of Directors oversees the Company’s risk management program, including the management of cybersecurity threats.
−Removed: The Board of Directors receives regular reports from the CTSO on cybersecurity threats and the Company’s strategy to manage the risks associated with such threats.
+Added: The Board of Directors receives regular reports from the CTSO on cybersecurity threats and the Company’s mitigation strategies.
The TIS Committee provides Management oversight of the Company’s cybersecurity risk management, business continuity planning and disaster recovery strategy and performance.
−Removed: To facilitate the success of the Company’s cybersecurity program, cross-functional teams work with the CISO and SOC to address cybersecurity threats and respond to cybersecurity incidents.
+Added: To facilitate the success of the Company’s cybersecurity program, cross-functional teams work with the CISO and SOC seek to address cybersecurity threats and respond to cybersecurity incidents.
Through ongoing communications with these teams, the CISO and Management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board of Directors, as appropriate.
2 unchanged sentences
Material Effects of Cybersecurity Incidents
−Removed: Previous cybersecurity incidents did not have, and are not reasonably likely to have, a material effect on the Company, including its business strategy, results of operations, or financial condition.
+Added: Past cybersecurity incidents have not had, and are not reasonably expected to have, a material impact on the Company’s business strategy, operations, or financial condition.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.