UNRESOLVED STAFF COMMENTS
+Added: Table of Content s
CYBERSECURITY
2 unchanged sentences
• Periodic cybersecurity program maturity assessments to evaluate the overall controls, processes, skills and platforms leveraged to assess, identify and manage material risks from cybersecurity threats.
−Removed: • Periodic Business Impact Assessments ("BIAs") of key business processes and services that enable us to identify sensitive and critical aspects of the business, the impact of operational disruptions to those processes and services and the sensitivity of the data leveraged in those processes and services.
+Added: • Periodic business impact assessments of key business processes and services that enable us to identify sensitive and critical aspects of the business, the impact of operational disruptions to those processes and services and the sensitivity of the data leveraged in those processes and services.
• An external assessment of the cybersecurity risks associated with our operations.
+Added: • Periodic penetration testing of our internal and external IT environment to validate the real-world efficacy of our cybersecurity program and mitigate the risks of new cybersecurity vulnerabilities.
We utilize internal information technology resources for the primary aspects of our cybersecurity program.
Our internal team is supported by external service providers and consultants as needed.
−Removed: To minimize the risk to our core systems, we utilize well established enterprise-grade cloud service providers for our management and operational functions.
−Removed: We review Service Organization Control Type 2 audit report results from each of these service providers to ensure that their programs meet our requirements.
−Removed: To reduce the risk that we are materially impacted by a cybersecurity incident, we employ a multi-layered defense approach to cybersecurity leveraging people, controls, tools and automated/monitored platforms to support the detection and response to cybersecurity incidents.
+Added: We utilize third-party service providers to manage portions of our business operations.
+Added: We have established processes to review, identify and manage cybersecurity risks associated with the use of service providers.
+Added: Prior to engaging these providers, we review the providers' SOC 2 Type II or other relevant security audit reports to ensure proper security controls are in place.
+Added: We evaluate the service providers' controls for incident response strategy to identify any significant risks and adapt accordingly.
+Added: We systematically review these assessments for any significant change throughout the relationship.
+Added: Our risk management program consistently monitors for risk to our systems and services presented by these service providers and promotes strategies to address any threats identified.
+Added: To reduce the risk that we are materially impacted by a cybersecurity incident, we employ a multi-layered defense approach to cybersecurity leveraging our people, external resources, controls, tools and automated/monitored platforms to support the detection and response to cybersecurity incidents.
We also have a cybersecurity incident response plan that outlines the steps we will take to respond to a cybersecurity incident, which is tested on a periodic basis.
−Removed: Finally, we conduct cybersecurity training and awareness programs for relevant employees and periodically conduct tabletop exercises leveraging actual scenarios to validate and improve our cybersecurity incident response plan and ensure that our management has a thorough understanding of and experience executing their roles and responsibilities if a cybersecurity incident were to occur.
+Added: Additionally, we have a retainer for external forensics support if required for a material incident.
+Added: Finally, we conduct cybersecurity training and awareness programs for relevant employees, periodically conduct tabletop exercises leveraging actual scenarios to validate and improve our cybersecurity incident response plan and ensure that our management has a thorough understanding of and experience executing their roles and responsibilities if a cybersecurity incident were to occur.
Our cybersecurity strategy and risk management program is a component of our overarching enterprise risk management program and interfaces with other functional areas within the Company, including our business segments, legal, risk, human resources and internal audit departments.
4 unchanged sentences
Our Board of Directors has primary responsibility for evaluating cybersecurity risk management, overseeing our major cybersecurity risk exposures and the steps management has taken to monitor and control these exposures, including policies and procedures for assessing and managing risk, as well as oversight of compliance related to legal and regulatory exposure.
−Removed: The management positions responsible for assessing and managing cybersecurity risks include our Director of Cybersecurity and our Chief Information Officer ("CIO"), who reports directly to our CFO.
+Added: The management positions responsible for assessing and managing cybersecurity risks include our Director of Cybersecurity and our Chief Information Officer ("CIO") , who reports directly to our Chief Executive Officer ("CEO").
Our CIO is responsible for ensuring that we have a cybersecurity risk management program in place that is fully aligned with business requirements and strategy.
−Removed: Our CIO and Director of Cybersecurity have over 19 and 20 years, respectively, of cybersecurity oversight experience.
+Added: Our CIO and Director of Cybersecurity both have over 20 years of cybersecurity oversight experience.
Our CIO previously served as CIO for a New York Stock Exchange listed manufacturing company prior to joining the Company.
Additionally, our Director of Cybersecurity has experience developing and implementing cybersecurity programs for multiple manufacturing firms.
+Added: Table of Content s
As part of our defined cybersecurity policies and cybersecurity incident response plan, management is regularly updated on the status of the execution of our cybersecurity strategy and daily operations of the program.
4 unchanged sentences
• Status of the execution of the cybersecurity strategy;
−Removed: • Summary of any non-material cybersecurity incidents that have occurred over the past quarter, including the nature, impact and resolution of incidents.
+Added: • Summary of any material cybersecurity incidents that have occurred over the past quarter, including the nature, impact and resolution of incidents.
In the event of a material cybersecurity incident, communication to the Board is provided pursuant to our cybersecurity incident response plan.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.