12 unchanged sentences
The results of this process are presented to our board of directors at least annually.
−Removed: In addition, our Information Technology (IT) Director provides quarterly updates to our board of directors on cybersecurity incidents, cybersecurity awareness activities, including results of mock-phishing exercises, regulatory and compliance matters specific to cybersecurity, and activities related to business continuity, including data validation and restore testing and tabletop exercises.
+Added: In addition, our Information Technology (IT) Director provides quarterly updates to our board of directors on
+Added: cybersecurity incidents, cybersecurity awareness activities, including results of mock-phishing exercises, regulatory and compliance matters specific to cybersecurity, and activities related to business continuity, including data validation and restore testing and tabletop exercises.
Risk assessment for cybersecurity threats is embedded into these quarterly updates, with each topic discussed being assigned a risk level.
5 unchanged sentences
Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our IT Director .
−Removed: Our current IT Director has been in his position since 2014 and has over 30 years of information technology, finance, and operational experience in our organization.
−Removed: Our IT Director is certified in governance of enterprise IT (CGEIT), is a Certified Data Privacy Solutions Engineer (CDPSE) and a Certified Information Systems Auditor (CISA).
+Added: Our current IT Director has been in his position since 2024 and has over 30 years of information technology and operational experience in our organization.
+Added: Our IT Director is certified in governance of enterprise IT (CGEIT).
+Added: Our IT security, data privacy and internal audit teams, each of which is involved in managing our cybersecurity risks, include professionals who hold certifications such as Certified Data Privacy Solutions Engineer (CDPSE), Certified Information Privacy Manager (CIPM), Certified Information Security Manager (CISM), Certified SCADA Security Architect (CSSA), Systems Security Certified Practitioner (SSCP), Certified Information Systems Auditor (CISA), Certified Internal Auditor (CIA), Certified Fraud Examiner (CFE), Certified Ethical Hacker (CEH), Certified Compliance and Ethics Professional (CCEP), CompTIA Network +, Security+ (Sec+), and Cybersecurity Analyst + (CySa+).
+Added: Many also hold graduate-level certifications and/or degrees in Threat Intelligence, Cyber Operations and Resilience, and Information Systems Management.
Our IT Director and other IT leaders systematically use the Control Objectives for Information and Related Technology (COBIT) framework as an IT governance framework and remain educated on other best practices in compliance, projects, and processes.
In addition, our IT Director reviews our operational plan annually with our operating segments, which includes review and discussion of a cybersecurity risk management framework.
−Removed: Our information services department, led by our IT Director, manages and continually enhances our information systems with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur.
+Added: Our information technology department, led by our IT Director, manages and continually enhances our information systems with the ultimate goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur.
We work to install new and upgrade existing information technology systems.
15 unchanged sentences
We use extended detection and response ( XDR) technology to integrate network, endpoint, and cloud data to stop sophisticated attacks by detecting malware and exploit threats, including using artificial intelligence (AI) behavioral analytics.
−Removed: We also partner with a security operation center (SOC) to provide 24-7 outside monitoring services for additional support to the internal IT team.
+Added: We also maintain cybersecurity insurance and partner with a security operation center (SOC) to provide 24-7 outside monitoring services for additional support to the internal IT team.
We have an established cross-functional IT incident response team , which includes our IT Director, to respond to cyber incidents effectively and to coordinate communications that may be necessary in the event of an incident.
13 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.