9 unchanged sentences
Our information security processes are designed to manage material risks from cybersecurity threats to our information systems and maintain the confidentiality, integrity and availability of our data.
+Added: We have also implemented a training program for employees that includes both proactive education modules, as well as reactive anti-phishing and testing modules designed to test the end-user’s ability to put what they learned into practice.
Engage Third-parties on Risk Management
6 unchanged sentences
Risks from Cybersecurity Threats
−Removed: We have not experienced a data or other cybersecurity breach in the past three years that have materially impaired our operations or resulted in a financial loss.
+Added: We have not experienced a cybersecurity threat or cybersecurity incident in the past three years that has materially adversely affected our results of operations or financial condition.
+Added: However, we face risks associated with breaches of our information technology systems, including through cyber-attacks and cyber intrusions, which could result in significant disruptions of our information technology systems (and those of third parties which we use), and unauthorized access to our information and information of our tenants and personnel.
+Added: As we previously disclosed, on May 1, 2024, we detected unauthorized occurrences by a third party on portions of our information technology systems.
+Added: Upon detecting the unauthorized occurrences, we promptly initiated our previously established response protocols and took steps to contain and remediate the incident.
+Added: As part of our remediation activities, we strengthened our surveillance of cybersecurity threats and our information backup systems.
+Added: A substantial portion of our direct costs incurred relating to containing, investigating and remediating the cybersecurity incident were reimbursed through insurance recoveries.
+Added: As of the date of this Annual Report on Form 10-K, the cybersecurity incident has not had a material impact on our financial condition or results of operations, and we do not believe the cybersecurity incident is reasonably likely to materially impact our financial condition or results of operations.
+Added: Refer to “Item 1A.
+Added: Risk Factors” in this Form 10-K, including “We have experienced, and may again experience, data security breach that may cause damage to our business and reputation,” for additional discussion about cybersecurity-related risks.
Governance and Oversight
12 unchanged sentences
The Audit Committee , comprised of board members with diverse experiences and expertise, is central to the Board’s oversight of management’s governance and management of cybersecurity risks and strategies.
−Removed: At least once each quarter, the CTIO provides reports to the Audit Committee, which include an update on cybersecurity practices and matters.
+Added: At least once each quarter, the CTIO provides reports to the Audit Committee, which include reports on any documented incidents or violations of our IT and security policies and an update on cybersecurity practices and matters.
+Added: Documented incidents or violations are discussed, and managers are notified for the appropriate follow-up with our human resources department or the employees involved in such incidents or violations, as needed.
+Added: Our Audit Committee regularly reviews with senior management our information technology and security policies and controls to address new and novel threats to our systems.
Additionally, the CTIO provides comprehensive briefings to the Board annually.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.