3 unchanged sentences
Management’s approach to assessing, identifying and managing cybersecurity and information security risks and threats is embedded in our overall Enterprise Risk Management (“ERM”) program.
−Removed: Management, in turn, reports up to our Board of Directors (the “Board”), which is responsible for oversight of risk, including with respect to cybersecurity threats.
+Added: Management, in turn, reports up to our Board of Directors (the “Board”), which is responsible for oversight of risk, including with respect to cybersecurity threats and information security.
Board and Management’s Role and Expertise and Oversight of Risk Management and Strategy
3 unchanged sentences
Our CISO, under the supervision and direction of the CIO, is responsible for developing and implementing our information security program.
−Removed: Our Executive Committee, made up of senior leaders throughout the organization, including our CIO, receives periodic reports from our CIO on both the state of our IT department and Information Security Office and on our cybersecurity programs.
+Added: Our Executive Committee, made up of senior leaders across the organization, including our CIO, receives periodic reports from our CIO on both the state of our IT department and Information Security Office and on our cybersecurity programs.
Our Board administers its risk oversight role directly and through its committee structure.
While our Board has ultimate responsibility for overseeing our cyber risk, our Audit Committee oversees risks related to cybersecurity threats, data protection, data privacy and business continuity.
−Removed: Our Audit Committee regularly discusses and, at least annually, reviews with management, including our CIO, CISO, Global Privacy Officer, our cyber, information security, and data privacy risks and programs.
−Removed: This review includes risk assessments, the implementation of policies, procedures, processes and controls for the management of risks, management’s actions to identify and detect cyber threats and incidents, results of tests and assessments and updates on our programs to manage disaster recovery, data privacy and compliance.
−Removed: Our management team also provides updates to the Board as needed.
−Removed: For instance, during the December 2022 cybersecurity incident, our Board and Audit Committee were regularly updated, and our Audit Committee provided oversight and feedback with respect to management’s investigation of, and response thereto, including internal and third-party investigations, public or governmental disclosures and our remediation efforts.
+Added: Our Audit Committee regularly discusses and, at least annually, reviews with management, including our CIO, CISO, and Global Privacy Officer, our cyber, information security, and data privacy risks and programs.
+Added: This review includes risk assessments, the implementation of policies, procedures, processes and controls for the management of risks, management’s actions to identify and detect cyber threats and incidents, the results of tests and assessments and updates on our programs to manage disaster recovery, data privacy and compliance.
+Added: Our management team also provides updates to the Board periodically.
Our IT department and Information Security Office, supported by our Global Privacy Office, regularly evaluate cybersecurity risks.
1 unchanged sentence
Our annual ERM program is reviewed and overseen by the Audit Committee and is presented to the Board annually.
−Removed: We maintain an internal Privacy and Security Steering Committee, co-chaired by our CISO and Global Privacy Officer and made up of members from IT, legal, privacy and international operations, and which is tasked with review of, and oversight over, our privacy and data security programs, policies and strategy.
−Removed: Our Governance, Risk and Compliance Committee, made up of members of legal, operations, human resources and internal audit as well as our CISO, provides additional support for enterprise risk management assessment and governance by monitoring our ERM program, and engaging with compliance functions across the organization to identify gaps, support corrective action plans and promote best practices.
+Added: We maintain an internal Privacy and Security Steering Committee, co-chaired by our CISO and Global Privacy Officer and made up of members from IT, legal, privacy and international operations, which is tasked with review of, and oversight over, our privacy and data security programs, policies and strategy.
+Added: Our Governance, Risk and Compliance Committee, made up of members of legal, operations, human resources and Internal Audit as well as our CISO, provides additional support for ERM assessment and governance by monitoring our ERM program, and engaging with compliance functions across the organization to identify gaps, support corrective action plans and promote best practices.
Our internal control over financial reporting, including key business process controls and IT general controls, are reviewed and tested by our Internal Audit function annually.
Assessment, Identification and Mitigation of Cybersecurity Threat Risk
−Removed: Our cybersecurity threat strategy is based on prevention, detection and mitigation using layered defenses, continuous assessment and monitoring, vulnerability scans, end-point detection and response and regular defense testing through simulations, penetration tests and table top exercises.
−Removed: While our cybersecurity policies, practices and programs may vary by location or by service, our overall cybersecurity risk management program leverages the ISO 27001 framework.
+Added: Our cybersecurity threat strategy is based on prevention, detection and mitigation using layered defenses, continuous assessment, monitoring through logging and correlation, vulnerability scans, cyber threat intelligence, end-point detection and response (EDR), and regular defense testing through simulations, penetration tests and table top exercises.
+Added: While our cybersecurity policies, practices and programs may vary by location or by service line, our overall cybersecurity management program is based on the ISO 27001 standard.
Our Information Security Office regularly monitors alerts and threat levels, trends, and remediation efforts, conducts post-incident reviews, conducts maturity testing to assess our processes and procedures and the threat landscape, reviews our operational policies and procedures, and conducts an annual risk assessment as described above.
We believe that these steps are useful tools in identifying and assessing risks, giving our team key information and insights used to manage those risks to help protect our clients, families, employees, vendors, investors, and our data and intellectual property.
−Removed: Employees are required to complete a cybersecurity training at least once a year specific to their role and we also require employees in certain other roles to complete additional role-based, specialized cybersecurity trainings.
−Removed: We have a set of policies and procedures addressing information security concerns governed by the Written Information Security Program (WISP) framework, other policies that directly or indirectly relate to cybersecurity, such as encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information as well as policies related to the use of the internet, social media, email and electronic devices.
+Added: Employees are required to complete a cybersecurity training annually specific to their role and we also require employees in certain other roles to complete additional role-based, specialized cybersecurity trainings.
+Added: We have a set of policies and procedures addressing information security concerns governed by our Written Information Security Program (WISP), other policies that directly or indirectly relate to cybersecurity, such as encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information as well as policies related to the use of the internet, social media, email and electronic devices.
These policies go through an internal review process and are approved by our internal Policy Board or Privacy and Security Steering Committee.
−Removed: We currently maintain a System and Organization Controls (“SOC”) Type 2 report for material applications and ISO 27001 and ISO 27701 certifications for the U.S.
−Removed: Annually, our Internal Audit function conducts a security audit in accordance with the ISO 27001 framework.
+Added: We currently maintain a System and Organization Controls (“SOC”) Type 2 report for material applications and ISO 27001 and ISO 27701 certifications for the United States and United Kingdom.
+Added: Annually, our Internal Audit function conducts a security audit in accordance with the ISO 27001 standard.
Third parties also play a role in our cybersecurity risk management and strategy.
2 unchanged sentences
Incident Response and Reporting
−Removed: In the event of a cybersecurity incident, we follow an Incident Response Manual and process led by our CISO which governs our assessment, response, and notifications process, internally and externally.
−Removed: Depending on the nature and severity of an incident, this process includes review by an incident response team, made up of members of the Information Security Office, with escalating notifications up to our CIO, Legal Department, CFO, and CEO followed by our Audit Committee Chair and the full Board.
+Added: In the event of a cybersecurity incident, we follow an Incident Response Manual and process led by our CISO which governs our assessment, response, escalation and notifications process, both internally and externally.
+Added: Depending on the nature and severity of an incident, this process includes review by an incident response team, made up of members of the Information Security Office, with escalating notifications up to our CIO, Legal Department, CFO, and CEO followed by our Audit Committee and the full Board.
Oversight of Third-Party Providers
−Removed: When engaging with third-party providers or suppliers with access to our network, systems or data or a third party providing cybersecurity support or infrastructure, we assess and evaluate their cybersecurity preparedness.
−Removed: Depending on location and level of access to data, vendors complete an information security questionnaire and/or provide a SOC 1 or SOC 2 report and, for vendors unable to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness.
+Added: When engaging with third-party providers or suppliers with access to our network, systems or data or a third party providing cybersecurity support or infrastructure, we assess and evaluate their cybersecurity and disaster recovery preparedness.
+Added: Depending on location and level of access to data, vendors complete an information security questionnaire and/or provide an independent information security audit report and, for vendors unable to provide such audit reports, we take additional steps to assess their cybersecurity preparedness.
We also include security and privacy addenda in our supplier contracts where applicable.
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.