2 unchanged sentences
Our information security program is designed to meet the needs of our clients who entrust us with their sensitive information.
−Removed: We maintain International Organization for Standardization (“ISO”) 27001 certification for most of our business units and core applications and facilities, and, where applicable, align to other industry standards or frameworks, including Cloud Security Alliance’s Cloud Controls Matrix (“CSA CCM”), Payment Card Industry Data Security Standard (“PCI DSS”), Health Insurance Portability and Accountability Act (“HIPAA”), and HITRUST Common Security Framework (“HITRUST CSF”).
+Added: We maintain International Organization for Standardization 27001 certification for our enterprise-wide information security management system and program.
+Added: Where applicable, we align to other industry standards or frameworks, including the Cloud Security Alliance’s Cloud Controls Matrix, the Payment Card Industry Data Security Standard, the Health Insurance Portability and Accountability Act, and the CSF HiTRUST Common Security Framework.
Cybersecurity Risk Management and Strategy
We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats.
−Removed: Our cybersecurity risk management program is integrated into our overall enterprise risk management (“ERM”) process which provides an ongoing procedure, effected at all levels of the Company across business units and corporate functions, to identify and assess risk, monitor risk, and take appropriate mitigating action.
−Removed: Central to our risk management process is the Risk Committee, which is a management committee that oversees the identification and assessment of the key risks affecting our operations and reviews the controls established with respect to these risks.
−Removed: The Risk Committee is comprised of key members of management, including the President, Chief Financial Officer, Chief Legal Officer, Chief Information Security Officer, Chief Privacy Officer, and other senior executives of the Company.
+Added: Our cybersecurity risk management program is integrated into our overall enterprise risk management (“ERM”) process which provides an ongoing procedure, effected at all levels of the Company and across business units and corporate functions, to identify and assess risk, monitor risk, and take appropriate mitigating action.
+Added: Central to our risk management process is the Risk Committee, a management committee that oversees the identification and assessment of the key risks affecting our operations and reviews the controls established with respect to these risks.
+Added: The Risk Committee is comprised of key members of management, including the President, Chief Financial Officer, Chief Legal Officer, Chief Information Security Officer, Chief Technology Officer, Chief Compliance Officer, and other senior executives of the Company.
Our Risk Committee collaborates with subject matter experts, as needed, to gather insights for identifying and assessing material cybersecurity risks, their severity, and potential mitigations .
4 unchanged sentences
government as a guideline to manage our cybersecurity-related risk.
−Removed: We are currently evaluating our program against the newly issued NIST Framework 2.0.
The NIST Framework outlines security controls and outcomes over five functions:
4 unchanged sentences
• conduct information security reviews and due diligence on key service providers to identify, assess, mitigate, and monitor risks associated with our use of third-party software and services;
−Removed: • maintain global information security policies and procedures, including an incident response and crisis management plan which include processes to triage, assess, investigate, escalate, contain, and remediate cybersecurity incidents.
−Removed: We further describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “Security breaches or cybersecurity incidents could adversely affect our ability to operate, could result in personal, confidential or proprietary information being misappropriated, and may cause us to be held liable or suffer harm to our reputation.,” included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.
+Added: • maintain global information security policies and procedures, including an incident response and crisis management plan that include processes to triage, assess, investigate, escalate, contain, and remediate cybersecurity incidents.
+Added: We further describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “Security breaches or cybersecurity incidents could adversely affect our financial results and our ability to operate, could result in personal, confidential or proprietary information being misappropriated, and may cause us to be held liable or suffer harm to our reputation,” included as part of our risk factor disclosures at Item 1A.
+Added: of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.
Cybersecurity Governance
Our information security program and team are currently managed by our Chief Information Security Officer (“CISO”) who reports to our Chief Technology Officer.
−Removed: Our CISO has more than 25 years of experience in managing and leading cybersecurity functions which includes cybersecurity operations, strategy and governance, and information technology and security risk, compliance, and audit responsibilities across the U.S., Latin America, United Kingdom, Eastern Europe, Singapore, and China.
+Added: Our CISO has more than 25 years of experience in managing and leading cybersecurity functions including cybersecurity operations, strategy and governance, and information technology and security risk, compliance, and audit responsibilities across the U.S., Latin America, United Kingdom, Eastern Europe, Singapore, and China.
Our CISO is responsible for developing, implementing, and overseeing our overall information security program, including cybersecurity risk management, governance and compliance, security policies and training, and the overall protection and defense of our networks, systems, and confidential data.
−Removed: With respect to risk management, our CISO works closely with our Managing Director, Risk Management, and other members of our Risk Committee, including the President, Chief Financial Officer, Chief Legal Officer, and Chief Technology Officer, who are responsible for reviewing and challenging, as necessary, the activities of our information security team.
−Removed: The responsibilities of the Company’s Board of Directors (“Board”) include oversight of our risk management processes.
+Added: With respect to risk management, our CISO works closely with our Managing Director, Risk Management, and other members of our Risk Committee, who are responsible for reviewing and challenging, as necessary, the activities of our information security team.
+Added: The responsibilities of the Company’s Board include oversight of our risk management processes.
The Board has two primary methods of oversight.
−Removed: The first method is through the ERM process through which the Board receives regular reports from management regarding the most significant risks facing the Company.
+Added: The first method is the ERM process through which the Board receives regular reports from management regarding the most significant risks facing the Company.
The second is through the functioning of the Board’s committees.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.