4 unchanged sentences
The Governance Committee of our Board of Directors oversees the Company’s guidelines, policies and processes to assess and manage the Company’s exposure to risks, which include cybersecurity risks.
−Removed: The Committee meets periodically with management to review and discuss major financial risk exposures, including from cybersecurity threats, and the steps management has taken to monitor and control those exposures.
+Added: The Governance Committee meets periodically with management to review and discuss major financial risk exposures, including from cybersecurity threats, and the steps management has taken to monitor and control those exposures.
As necessary, our Cybersecurity Incident Management Team ("CIMT") (described below) reports significant cybersecurity threats and incidents to the Governance Committee.
5 unchanged sentences
and running the day-to-day operations of our cybersecurity team.
−Removed: Our CDO holds a bachelor’s degree in electronics and telecommunications engineering and has more than 35 years of information technology and cybersecurity experience in various leadership and executive roles.
+Added: Our CDO holds a bachelor’s degree in electrical engineering and technology and a master’s degree in technology and has more than 22 years of information technology and cybersecurity experience in various leadership and executive roles.
In addition, our IT Director, Cyber Security holds a bachelor’s degree in computer information systems and the Certified Information Systems Security Professional ("CISSP") and Information Systems Security Architecture Professional ("ISSAP") certifications, as well as over 30 years of experience as an information technology professional with the most recent 15 years specializing in cybersecurity.
15 unchanged sentences
In general, when our cybersecurity team detects a cybersecurity threat by way of an alert within our cyber defense systems, employee notice, or otherwise, our IT Director, Cyber Security, along with other relevant personnel, is promptly apprised of the situation, and actively takes steps to prevent, mitigate, or remediate that threat.
−Removed: If a cybersecurity threat appears to progress into a possible cybersecurity incident, our IT Director, Cyber Security serves as the CIMT’s incident manager and the CDO or designee notifies the Chief Risk
−Removed: Officer of a need to activate the CIMT as appropriate, informs and updates the CIMT and may consult other internal and external resources with the required technical, application, organizational and business knowledge to provide effective advice to the CIMT.
+Added: If a cybersecurity threat appears to progress into a possible cybersecurity incident, our IT Director, Cyber Security serves as the CIMT’s incident manager and the CDO or designee notifies the Chief Risk Officer of a need to activate the CIMT as appropriate, informs and updates the CIMT and may consult other internal and
+Added: external resources with the required technical, application, organizational and business knowledge to provide effective advice to the CIMT.
The CIMT responds to potential cybersecurity incidents raised to its attention by making an assessment of the event to determine if a cybersecurity incident has, in fact, occurred, identifying any assets impacted by the incident, determining any information stored and processed by assets identified as compromised, assessing the nature and level of damage that has occurred (accessed, exfiltrated, released to the public, etc.) and revising the assessment throughout the incident response process when additional details are identified.
Government contractor, we may be prone to a greater number of cybersecurity threats than companies in other industries.
−Removed: We believe we are well positioned to meet the requirements of the Cybersecurity Maturity Model Certification ("CMMC") program and are preparing for certification once the requirements are effective.
−Removed: As of the date of this Report, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition.
+Added: As of the date of this Report, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition during the prior three fiscal years.
However, there can be no guarantee that cybersecurity threats and incidents will not materially affect us in the future.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.