15 unchanged sentences
Our management team also provides updates to the Board periodically.
−Removed: Our IT department and Information Security Office, supported by our Global Privacy Office, regularly evaluate cybersecurity risks.
+Added: Our IT department and Information Security Office, supported by our Global Privacy Officer, regularly evaluate cybersecurity risks.
Cybersecurity risks are considered within our ERM framework, which are assigned risk owners to develop and manage mitigation programs.
6 unchanged sentences
While our cybersecurity policies, practices and programs may vary by location or by service line, our overall cybersecurity management program is based on the ISO 27001 standard.
−Removed: Our Information Security Office regularly monitors alerts and threat levels, trends, and remediation efforts, conducts post-incident reviews, conducts maturity testing to assess our processes and procedures and the threat landscape, reviews our operational policies and procedures, and conducts an annual risk assessment as described above.
−Removed: We believe that these steps are useful tools in identifying and assessing risks, giving our team key information and insights used to manage those risks to help protect our clients, families, employees, vendors, investors, and our data and intellectual property.
−Removed: Employees are required to complete a cybersecurity training annually specific to their role and we also require employees in certain other roles to complete additional role-based, specialized cybersecurity trainings.
+Added: Our Information Security Office regularly monitors alerts and threat levels, trends, industry best practices, and remediation efforts, conducts post-incident reviews, conducts maturity testing to assess our processes and procedures and the threat landscape, reviews our operational policies and procedures, and conducts an annual risk assessment as described above.
+Added: We believe that these steps are useful tools in identifying and assessing risks, giving our team key information and insights used to manage those risks to help protect our clients, families, employees, vendors, stockholders, and our data and intellectual property.
+Added: Depending on their role, employees are required to complete a cybersecurity training annually and we also require employees in certain other roles to complete additional role-based, specialized cybersecurity trainings.
We have a set of policies and procedures addressing information security concerns governed by our Written Information Security Program (WISP), other policies that directly or indirectly relate to cybersecurity, such as encryption standards, antivirus protection, remote access, multi-factor authentication, confidential information as well as policies related to the use of the internet, social media, email and electronic devices.
These policies go through an internal review process and are approved by our internal Policy Board or Privacy and Security Steering Committee.
−Removed: We currently maintain a System and Organization Controls (“SOC”) Type 2 report for material applications and ISO 27001 and ISO 27701 certifications for the United States and United Kingdom.
+Added: We currently maintain a System and Organization Controls (“SOC”) Type 2 report for material applications and ISO 27001, ISO 27701 and ISO 22301 certifications for the United States and United Kingdom.
Annually, our Internal Audit function conducts a security audit in accordance with the ISO 27001 standard.
Third parties also play a role in our cybersecurity risk management and strategy.
−Removed: We contract with a third-party cybersecurity incident response team to assist in the management of cybersecurity threats.
+Added: We maintain relationships with third-party cybersecurity incident response teams to assist in the management of cybersecurity threats.
We also engage and rely on third-party cyber and information security providers for cybersecurity applications and infrastructure to protect our network, systems and data.
5 unchanged sentences
Depending on location and level of access to data, vendors complete an information security questionnaire and/or provide an independent information security audit report and, for vendors unable to provide such audit reports, we take additional steps to assess their cybersecurity preparedness.
−Removed: We also include security and privacy addenda in our supplier contracts where applicable.
−Removed: Our assessment of cybersecurity threats associated with our third-party providers is part of our overall cybersecurity risk management framework.
+Added: We also include security and privacy addenda in our supplier contracts when applicable.
+Added: Our assessment of cybersecurity threats associated with our third-party providers is part of our overall cybersecurity risk management framework, and certain vendors are assessed for security, privacy and AI (if applicable) risks, and are assigned an assessment cadence based on their access and risk profile.
+Added: Certain critical vendors are continuously monitored using a third-party monitoring software.
Impact of Cyber Risk on our Business
1 unchanged sentence
We continue to invest in the security and strength of our networks and to enhance our internal controls and processes, which are designed to help protect our systems, infrastructure, and data.
−Removed: To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, such as the December 2022 cybersecurity incident, have not materially affected our business strategy, results of operations or financial condition.
+Added: To date, risks from cybersecurity threats, including previous cybersecurity incidents, have not materially affected our business strategy, results of operations or financial condition.
While we maintain cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.