10 unchanged sentences
• Identification and Reporting:
−Removed: The Company strives to have controls and procedures designed to identify, assess, manage and respond to cybersecurity threats and incidents, including fulfilling potential public disclosure or reporting requirements as may be applicable.
+Added: The Company strives to have controls and procedures reasonably designed to identify, assess, manage and respond to cybersecurity threats and incidents, including fulfilling potential public disclosure or reporting requirements as may be applicable.
• Technical Safeguards:
2 unchanged sentences
The Company seeks to comply with the cybersecurity framework guidelines issued by the NIST and ISO.
+Added: • Independent Assessments:
+Added: The Company engages independent third-party service providers to support and enhance its cybersecurity risk management program.
+Added: These third parties perform periodic security testing, assessments, and reviews designed to evaluate the effectiveness of the Company’s security controls and identify potential vulnerabilities.
+Added: Such activities include:
+Added: (i) vulnerability assessments and penetration testing of web applications, infrastructure, and select mobile environments conducted using industry-recognized methodologies;
+Added: (ii) the use of an independent certification body to conduct ISO-based assessments and certifications of the Company’s information security management program;
+Added: (iii) testing of information technology general controls by an external audit firm as part of the Company’s Sarbanes-Oxley (“SOX”) compliance program;
+Added: (iv) periodic reviews conducted by the Company’s cybersecurity insurance provider in connection with underwriting and renewal processes;
+Added: and (v) independent
+Added: Table of Content
+Added: cybersecurity testing and assessments performed by certain clients as part of their vendor risk management and regulatory oversight processes.
+Added: Management reviews the results of these third-party activities and incorporates relevant findings into its ongoing cybersecurity risk management efforts.
• Education and Awareness:
−Removed: The Company provides periodic, mandatory training for all levels of employees regarding information security, cybersecurity threats, business continuity planning and disaster recovery in an effort to equip Company employees with tools to address cybersecurity threats, and to communicate the Company’s evolving information security policies, standards, processes and practices.
+Added: The Company provides periodic, training for all levels of employees regarding information security, cybersecurity threats, business continuity planning and disaster recovery in an effort to equip Company employees with tools to address cybersecurity threats, and to communicate the Company’s evolving information security policies, standards, processes and practices.
• Incident Response and Recovery Planning:
2 unchanged sentences
The Company has established and seeks to maintain comprehensive incident identification, containment, response and business continuity plans designed to respond to potential cybersecurity incidents.
−Removed: The Company strives to conduct periodic drills and tabletop exercises to test these.
+Added: The Company strives to conduct periodic drills and tabletop exercises to test its procedure.
• Third-Party Risk Management:
3 unchanged sentences
the CISO reviews critical results with the TIS Committee.
−Removed: The Board of Directors oversees the Company’s risk management program, including the management of cybersecurity threats.
−Removed: The Board of Directors receives regular reports from the CTSO on cybersecurity threats and the Company’s mitigation strategies.
−Removed: The TIS Committee provides Management oversight of the Company’s cybersecurity risk management, business continuity planning and disaster recovery strategy and performance.
−Removed: To facilitate the success of the Company’s cybersecurity program, cross-functional teams work with the CISO and SOC seek to address cybersecurity threats and respond to cybersecurity incidents.
−Removed: Through ongoing communications with these teams, the CISO and Management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Board of Directors, as appropriate.
+Added: There can be no assurance that these risks management strategies and assessments will be effective.
+Added: The Company maintains a formal cybersecurity governance structure.
+Added: The SOC monitors the Company’s information systems on an ongoing basis and escalates identified threats and incidents to CISO .
+Added: The Company maintains a cross-functional incident response team composed of representatives from the following departments:
+Added: Information Security, Information Technology, Law and Compliance, and Enterprise Risk.
+Added: Significant cybersecurity incidents and risks are escalated to management through the TIS Committee.
+Added: The Board of Directors receives quarterly updates regarding cybersecurity risk management, threat landscape developments, and mitigation efforts.
+Added: In the event of a material cybersecurity incident, the Board would be notified and would receive updates regarding investigation status, impact assessment, and remediation activities.
+Added: The Company conducts periodic incident response drills and tabletop exercises to test its incident response procedures, business continuity plans, crisis management processes, and management preparedness in the event of a significant cybersecurity incident.
The CISO has served in various roles in information technology, information security, and business continuity for over 20 years.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.