5 unchanged sentences
We assess industry best practices and standards and endeavor to leverage them in our efforts to manage cybersecurity risk.
−Removed: We dedicate resources and apply security controls where we believe they would be most effective to predict, prevent, detect and respond to potential security threats to our highest value information assets, which we consider to be point-of-sale systems, financial systems and confidential, personal and private customer and employee information.
−Removed: We use multiple safeguards to protect our internal networks and systems, including, among others, firewalls, email protection and web filtering, endpoint detection and response software, controlled access to our data and systems,
BLOOMIN’ BRANDS, INC.
−Removed: segmenting our card data environment, vulnerability management and patching, and performing regular penetration testing.
+Added: resources and apply security controls where we believe they would be most effective to predict, prevent, detect and respond to potential security threats to our highest value information assets, which we consider to be point-of-sale systems, financial systems and confidential, personal and private customer and employee information.
+Added: We use multiple safeguards to protect our internal networks and systems, including, among others, firewalls, email protection and web filtering, endpoint detection and response software, controlled access to our data and systems, segmenting our card data environment, vulnerability management and patching, and performing regular penetration testing.
A risk assessment, based on the National Institute of Standards and Technology Framework, is conducted and maintained throughout the system development lifecycle and is reviewed at least annually.
14 unchanged sentences
In the event we experience an incident, we classify it based on its significance and track remediation actions and outcomes.
−Removed: Although we do not believe we have been materially affected by cybersecurity incidents or threats in the past, we cannot provide any assurance that we will not experience a material incident in the future.
+Added: Although we do not believe we have been materially affected by cybersecurity incidents or threats in the past, or that past incidents are reasonably likely to materially affect us, we cannot provide any assurance that we will not experience a material incident in the future.
As described above, we utilize a risk-based approach to manage cybersecurity risk and it is possible we may not implement appropriate controls if we do not recognize or underestimate a particular risk.
2 unchanged sentences
Our Board of Directors (our “Board”) has charged the Audit Committee with oversight of the Company’s identification, assessment and management of cybersecurity and data privacy risks.
−Removed: As part of its oversight of our enterprise risk management program, the Audit Committee periodically reviews and prioritizes key risks facing our Company, including cybersecurity risk.
−Removed: The Audit Committee receives quarterly updates from our head of information security and our Chief Technology Officer (“CTO”) regarding our cybersecurity program and actions taken to manage cybersecurity risk, which include risk identification and management strategies, consumer data protection, security programs, ongoing risk mitigation activities and results of third-party assessments and testing.
+Added: The Audit Committee receives quarterly updates from our Chief Information Security Officer (“CISO”) and our Chief Information Officer (“CIO”) regarding our cybersecurity program and actions taken to manage cybersecurity risk, which include risk identification and management strategies, consumer data protection, security programs, ongoing risk mitigation activities and results of third-party assessments and testing.
We maintain a dedicated cybersecurity department, which consists exclusively of Company employees, within our broader information technology department.
−Removed: Functions within this department range from new information technology solution design and implementation, vulnerability management, phishing awareness, threat detection, Payment Card Industry compliance and incident response.
−Removed: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the head of information security, who has over 25 years of experience in the field of cybersecurity, including prior service in the military in cybersecurity roles, and relevant industry certifications commensurate with his role.
−Removed: Our head of information security reports directly to the CTO who has over 20 years of restaurant technology experience.
+Added: Functions within this department range from new information technology solution design and implementation, vulnerability management, phishing awareness, threat detection,
BLOOMIN’ BRANDS, INC.
−Removed: Our CTO receives status reports from our cybersecurity department regularly and reports to our Chief Executive Officer, who receives updates on incidents, trends, projects and other relevant information regularly.
+Added: Payment Card Industry compliance and incident response.
+Added: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the CISO, who has over 25 years of experience in the field of cybersecurity, including prior service in the military in cybersecurity roles, and relevant industry certifications commensurate with his role.
+Added: Our CISO reports directly to the CIO who has over 20 years of technology leadership experience in various industries.
+Added: Our CIO receives status reports from our cybersecurity department regularly and reports to our Chief Executive Officer, who receives updates on incidents, trends, projects and other relevant information regularly.
In addition, as part of our incident response planning, we maintain cross-functional response teams to be prepared to respond to an incident.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.