3 unchanged sentences
The Board’s Audit Committee oversees risks relating to cybersecurity threats and the steps management takes to monitor and control such exposures.
−Removed: The Company has instituted an Information Security Incident Response Plan (“IRP”) which provides a framework to assist the Company in responding to actual or potential cybersecurity incidents.
+Added: In addition to other written policies and procedures, the Company has instituted an Information Security Incident Response Plan (“IRP”) which provides a framework to assist the Company in responding to actual or potential cybersecurity incidents.
Our IRP includes detailed response procedures to be followed in the event of a cybersecurity incident, which outline steps to be executed from detection to assessment to notification and recovery, including internal notifications to the Audit Committee as appropriate.
These incidents may consist of any actual, threatened, suspected, or reported event or occurrence that may affect the confidentiality, integrity, or availability of Company systems or data, or of any such event affecting a third party that may affect Company systems or data.
−Removed: The objective of the IRP is to facilitate a timely and coordinated enterprise-level response to such incidents to mitigate impact on the Company and its employees, stockholders, customers, business partners, and other stakeholders.
+Added: T he objective of the IRP is to facilitate a timely and coordinated enterprise-level response to such incidents to mitigate impact on the Company and its employees, stockholders, customers, business partners, and other stakeholders.
The Audit Committee receives regular reporting from senior officers (such as the Chief Information Security Officer and the Director of Risk Management & Insurance) on operational risk and the steps management has taken to monitor and control these risks.
18 unchanged sentences
When activated, the ISIRT coordinates and directs all aspects of the response, including, as applicable, investigation, containment, business continuity and recovery, remediation, notifications, communications, and post-incident activities with executive leadership, including the CIO, and the Audit Committee and/or Board of Directors, as appropriate in the circumstances.
−Removed: As of December 31, 2023, no identified risk has required activation of the ISIRT.
+Added: As o f December 31, 2024, no identified risk has required activation of the ISIRT.
In addition, our third-party service providers play a role in our risk management and strategy as well as with the investigation of cybersecurity incidents.
2 unchanged sentences
We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.
+Added: The Company also conducts appropriate cybersecurity exercises and training.
+Added: For example, employees must complete cybersecurity training on at least an annual basis, which educates our employees on the Company’s policies and procedures for handling personal data, incident reporting, and avoiding common cybersecurity threats such as phishing attacks.
For a discussion of information technology rights that may materially impact us, see Item 1A “ Risk Factors — We rely on information technology to support our operations and reporting environments.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.