7 unchanged sentences
We have established and implemented processes to assess, identify and manage material cybersecurity risks.
−Removed: Cybersecurity risks are assessed, identified, and managed by our Executive Director of Cybersecurity and Infrastructure, with direct supervision by our Vice President and Chief Information Officer (“CIO”) and with the assistance of our internal audit and legal teams.
−Removed: Our Executive Director of Cybersecurity and Infrastructure shares information regarding such risks with our management’s senior level information security council (the “Information Security Council”), which consists of our CIO, Senior Vice President and Chief Financial Officer, Vice President and Chief Technical Officer, Senior Vice President and Chief Legal Officer & Corporate Secretary (currently vacant), Vice President of Strategy and Director of Internal Audit & Enterprise Risk Management, and which supports the Audit Committee’s oversight of cybersecurity risk, including by providing regular reports on various cybersecurity matters.
+Added: Cybersecurity risks are assessed, identified, and managed by our Executive Director of Cybersecurity and Infrastructure, with direct supervision by our Chief Information Officer (“CIO”) and with the assistance of our internal audit and legal teams.
+Added: Our Executive Director of Cybersecurity and Infrastructure shares information regarding such risks with our management’s senior level information security council (the “Information Security Council”), which consists of our CIO, Senior Vice President and Chief Financial Officer, Vice President and Chief Technical Officer, Senior Vice President and Chief Legal Officer & Corporate Secretary, Senior Vice President of Strategy and President, Industrial Solutions and Director of Internal Audit & Enterprise Risk Management, which supports the Audit Committee’s oversight of cybersecurity risk, including by providing regular reports on various cybersecurity matters.
We have in place robust physical, technical, administrative and organizational controls for the securing of our information systems.
3 unchanged sentences
Any third-party service providers with access to confidential or sensitive data are subject to ongoing oversight activities, including assessments and audits, throughout the lifetime of the engagement.
−Removed: Additionally, we maintain an incident response plan (the “Incident Response Plan”), which establishes a comprehensive, effective, and repeatable process for identifying, escalating and responding to cybersecurity incidents.
+Added: Additionally, we maintain an incident response plan (the “Incident Response Plan”), which establishes a comprehensive, effective, and repeatable process for identifying, escalating and responding to cybersecurity
We test and evaluate the Incident Response Plan, including contingency and recovery plans, on a regular basis, and we develop, implement and review contingency and recovery plans for information systems, both internal and vendor managed.
−Removed: The results of such assessments drive changes and enhancements to
−Removed: governance, policies, procedures, technologies, and partner decisions to continuously monitor and improve our cybersecurity risk management.
+Added: The results of such assessments drive changes and enhancements to governance, policies, procedures, technologies, and partner decisions to continuously monitor and improve our cybersecurity risk management.
The Information Security Council practices the procedures of the Incident Response Plan through tabletop exercises facilitated by external consultants.
6 unchanged sentences
The Audit Committee receives regular presentations and reports from our Executive Director of Cybersecurity and Infrastructure and our CIO on cybersecurity risks and prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.
−Removed: Our Executive Director of Cybersecurity and Infrastructure and our CIO also report to the Board at least annually and to Audit Committee at least quarterly on current internal and external developments in cybersecurity, as part of the Board’s enterprise risk management review, and the Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk.
+Added: Our Executive Director of Cybersecurity and Infrastructure and our CIO also report to the Board at least annually and to the Audit Committee at least quarterly on current internal and external developments in cybersecurity, as part of the Board’s enterprise risk management review, and the Board receives reports of Audit Committee discussions regarding its oversight of cybersecurity risk.
We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, reported to the Audit Committee or the Board in a timely manner.
Our Global Cybersecurity Operations function is a global team led by our Executive Director of Cybersecurity and Infrastructure, who reports to our CIO.
−Removed: In turn, our CIO reports to our Chief Executive Officer.
+Added: In turn, our CIO reports to our Chief Financial Officer.
The Information Security Council provides additional oversight for assessing and managing cybersecurity risk .
Our Executive Director of Cybersecurity and Infrastructure has over 15 years of cybersecurity and information technology experience, including as Director of Cybersecurity for various institutions.
−Removed: Our Executive Director of Cybersecurity and Infrastructure has a Bachelor of Science in Information Science and Technology and a master’s degree in information sciences, cybersecurity, and information assurance, and he has a Certified Information Systems Security Professional certification, a GIAC Information Security Professional certification and a CompTIA Network+ ce certification.
−Removed: Our CIO has over 25 years of information technology experience, including serving in the information technology function at Cummins Inc., where she served as the information technology leader for Cummins Filtration Inc.
−Removed: Our CIO holds an undergraduate degree in business administration with emphasis in management information systems.
+Added: Our Executive Director of Cybersecurity and Infrastructure has a Bachelor of Science in Information Science and Technology and a Master’s of Science in Information Sciences, Cybersecurity, and Information Assurance, and a Doctorate in Cybersecurity;
+Added: he also has a Certified Information Systems Security Professional certification, a GIAC Information Security Professional certification and a CompTIA Security+ certification.
+Added: Our CIO has over 30 years of experience in information technology, having held multiple executive leadership roles, including CIO positions at several organizations.
+Added: Our CIO holds a bachelor’s degree in computer science.
Each of the other members of the Information Security Council have relevant educational and industry experience, including managing risks at our Company and at similar companies.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.