4 unchanged sentences
Accordingly, the Company takes a comprehensive approach to identifying and managing cybersecurity risks that involves the Company’s information technology security team, senior management, Audit Committee and Board of Directors.
+Added: Tab l e of Contents
+Added: cybersecurity risk management function is a component of our overall approach to risk management, which is implemented and overseen by our Enterprise Risk Management Committee.
+Added: Cybersecurity Risk Management and Strategy
Our cybersecurity risk management function is a component of our overall approach to risk management, which is implemented and overseen by our Enterprise Risk Management Committee.
+Added: The Company’s cybersecurity risk management policies and procedures, which are based upon the CIS v8 Framework, portions of the NIST Framework, ISO 27001, are designed to support the Company in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents.
+Added: These policies and procedures are reviewed and updated in connection with risk assessments, which identify reasonable and foreseeable risks.
+Added: Third-party and internal assessments are conducted annually to measure the effectiveness of safeguards, operating effectiveness of security measures, and to inform future considerations of the program.
+Added: The Company implements security policies throughout its operations and utilizes the enterprise risk management process designed to quantify, report, and plan to remediate identified cybersecurity risks.
+Added: Our cybersecurity risk management policies and procedures include:
+Added: • Third-party and internal risk assessments designed to help identify material cybersecurity risks to critical systems, data, services and general information technology environment.
+Added: • An annual review of third-party service providers critical to the operation of the Company.
+Added: • A third-party risk management framework designed to identify, monitor, remediate and respond to third-party cybersecurity risks and incidents.
+Added: • Cybersecurity awareness training program for all employees and contractors to inform and educate, with built in quantitative testing for effectiveness.
+Added: • A security team staffed with full-time employees and supplemented by a third party managed security service provider responsible for monitoring, investigating, and responding to potential incidents, threats, or breaches.
+Added: Although we have designed our cybersecurity risk management policies and procedures described above to mitigate cybersecurity risks, there can be no assurance that such policies and procedures will be fully implemented, complied with, or effective in protecting our systems and information.
+Added: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
Cybersecurity Governance
−Removed: The Company’s information technology security team, led by our Chief Information Security Officer (“CISO”), is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks to the Company’s senior management.
+Added: The Company’s information technology security team, led by our Chief Information Officer and Chief Information Security Officer (“CISO”), is responsible for identifying, assessing, mitigating, and reporting on material cybersecurity risks to the Company’s senior management.
The Company’s CISO, who has over 20 years’ experience in information technology, holds high-level licenses and certifications relating to information security, including the ISC2 CISSP.
3 unchanged sentences
The Board of Directors oversees the Company’s cybersecurity policies and procedures through the Audit Committee and also receives periodic briefings from senior management as well.
−Removed: Cybersecurity Policies and Procedures
−Removed: Under the direction of the Company’s CISO, the Company’s cybersecurity policies and procedures are designed to support the Company in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents.
−Removed: Such policies and procedures are based upon the CIS v8 Framework, portions of the NIST Framework, ISO 27001, and industry practices, with key areas outlined below:
−Removed: • Risk Management:
−Removed: Third party and internal risk assessments designed to help identify material cybersecurity risks to critical systems, data, services and general information technology environment, as well as regular testing to measure effectiveness of the risk assessments and controls.
−Removed: Reviews and testing of various controls are done on an annual basis within the Company.
−Removed: Third party vendors critical or material to the operation of the company are reviewed on an annual basis to ensure they continue to meet our security criteria.
−Removed: There is also a communication process in place to question third party vendors around specific or emerging vulnerabilities and zero days outside the annual review.
−Removed: • Security Operations Center (SOC):
−Removed: Staffed by full time employees and supplemented by a MSSP, 24/7 monitoring, investigating, and responding to potential incidents, threats, or breaches.
−Removed: • Education & Awareness:
−Removed: Information training programs for all employees and contractors to inform and educate, with built in quantitative testing for effectiveness.
−Removed: • Risk Management Framework:
−Removed: A third party risk management framework, designed to identify, monitor, remediate and respond to third party cybersecurity risks and incidents.
−Removed: This framework includes a due diligence process that occurs before and during the engagements with third parties, and through the use of third party threat intelligence reports and feeds to monitor breaches and incidents.
−Removed: • Incident Response & Recovery (IRR):
−Removed: Established, tested incident response and recovery policies and procedures utilized by the SOC and other key members of the IRR team to effectively respond to threats in a timely consistent manner.
−Removed: • Technical Controls:
−Removed: Technical and administrative checks and balances to safeguard information and systems, including firewalls, XDR, logging, and access controls.
−Removed: These policies and procedures are reviewed and updated in connection with risk assessments, which identify reasonable and foreseeable risks.
−Removed: Third party and internal assessments are conducted annually to measure the effectiveness of safeguards, operating effectiveness of security measures, and to inform future considerations of the program.
−Removed: The Company implements security policies throughout its operations, and utilizes the enterprise risk management process designed to quantify, report, and plan to remediate identified cybersecurity risks.
Cybersecurity Risks and Threats
1 unchanged sentence
To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future.
−Removed: See the section entitled “ Risk Factors ” included elsewhere in this Annual Report for further information.
−Removed: We continuously work to enhance our cybersecurity risk management program.
+Added: Tab l e of Contents
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.