13 unchanged sentences
We engage third parties for advice and support in the design and implementation of certain program elements and leverage third-party tools to help identify and mitigate cybersecurity risks.
−Removed: Certain specific, defined components of our technology environment are assessed by third-party auditors with a view to alignment with industry standards such as, for example, the Payment Card Industry Data Security Standards.
+Added: Certain specific, defined components of our technology environment are assessed by third-party auditors with a view to align with industry standards such as, for example, the Payment Card Industry Data Security Standards.
We also periodically retain outside expertise to conduct a maturity assessment of our program against industry standards and participants.
−Removed: Our program is informed by industry standards such as, for example, the National Institute of Standards and Technology’s Framework for Improving Critical Infrastructure Cybersecurity (“NIST CSF”), but this does not imply that we meet all technical standards, specifications or requirements under the NIST CSF or other sources.
+Added: Our program is informed by industry standards such as, for example, the National Institute of Standards and Technology’s Cybersecurity Framework (“NIST CSF”), but this does not imply that we meet all technical standards, specifications or requirements under the NIST CSF, NIST CSF 2.0 or other sources.
We have combatted cybersecurity threats in the normal course of business, but prior cybersecurity incidents have not materially affected, and do not appear likely to materially affect, our operations, business strategy, results of operations or financial condition.
However, our Enterprise Risk Management program has recognized that we face ongoing risks from cybersecurity threats that, if not successfully prevented or mitigated, could materially affect us, including our operations, business strategy, results of operations or financial condition.
−Removed: For additional information on this risk, see Item 1A, Risk Factors, of this Annual Report on Form 10-K.
+Added: For additional information on such risks, see Item 1A, Risk Factors, of this Annual Report on Form 10-K.
Cybersecurity Governance
Our Board, with oversight by the Audit Committee, oversees management’s processes for identifying and mitigating cybersecurity risks.
−Removed: Executive management including our Chief Information Security Officer (“CISO”), who reports to our General Counsel & Chief Risk Officer, updates the Audit Committee on our cybersecurity posture no less frequently than quarterly and periodically update the full Board.
+Added: Executive management including our Chief Information Security Officer (“CISO”), who reports to our General Counsel & Chief Risk Officer, update the Audit Committee on our cybersecurity posture no less frequently than quarterly and periodically update the full Board.
Our EIP organization, led by our CISO, is responsible for the design and implementation of our information security program .
−Removed: Our current CISO has been with the Company for more than eight years—serving as our CISO for nearly seven years—and has extensive cybersecurity experience through leadership and consulting roles.
−Removed: His current leadership team comprising seven individuals has over 130 years of combined cybersecurity experience.
−Removed: These and other EIP team members work closely with stakeholders across the Company to implement the program’s policies, standards and processes and help ensure awareness that securing customer information and honoring our privacy promises are core employee obligations, as highlighted in our Code of Ethics and reinforced through our Valuable Information Protection training program.
+Added: Our current CISO has been with the Company for more than nine years—serving as our CISO for nearly eight years—and has extensive cybersecurity experience through leadership and consulting roles.
+Added: His current leadership team has over 100 years of combined cybersecurity experience.
+Added: These and other EIP team members work closely with stakeholders across the company to implement the program’s policies, standards and processes.
+Added: They also help ensure awareness that securing customer information and honoring our privacy promises are core employee obligations, as highlighted in our Code of Ethics and reinforced through our Valuable Information Protection training program.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.