2 unchanged sentences
The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company’s cybersecurity policies, standards, processes, and practices, which are integrated into the Company’s overall risk management program.
−Removed: We have adopted aspects of the ISO 27002, NIST SP 800-37 Rev.
−Removed: 2, and NIST Cybersecurity frameworks, to which risk management in relation to our information systems is aligned.
+Added: We have adopted NIST SP 800-37 Rev.
+Added: 2 and the NIST Cybersecurity Framework, and we have aligned our information systems risk management to these guidelines.
We categorize our information systems as either critical or secondary, depending on business value and/or risk of financial or compliance impact of cybersecurity incidents .
1 unchanged sentence
conducting routine vulnerability scanning of information systems assets;
−Removed: network/endpoint detection and response coupled with anomaly identification enhanced logging capabilities powered by artificial intelligence software;
+Added: network/endpoint detection, and response coupled with anomaly identification enhanced logging capabilities powered by AI software;
discovery through collaboration with the Company’s internal audit team;
9 unchanged sentences
The audit committee of the Company’s board of directors provides structured oversight of the Company’s risk management program, which focuses on the most significant short-, intermediate-, and long-term risks the Company faces.
−Removed: The Company has an information security compliance committee (the “Committee”) that consists of the members of the Company's compliance committee, which reports to the board of directors, and at least three members of Company management.
+Added: The Company has an information security compliance committee (the “Committee”) that consists of the members of the Company's compliance committee, which reports to our board of directors, and at least three members of Company management.
The Committee is responsible for overseeing the development and upkeep of written policies and procedures aimed at safeguarding the Company’s information systems and the nonpublic information stored within them.
4 unchanged sentences
At least annually, our internal audit team conducts a formal risk assessment and develops an audit plan that identifies, assesses, and prioritizes risks that include cybersecurity.
−Removed: The results of the risk assessment and the proposed audit plan are communicated to various leaders within the Company as well as the audit committee of the board of directors for input.
−Removed: The audit plan is reassessed throughout the year, and the plan is subject to modification by our internal audit team, e.g., based on such considerations as changes to resources, business operations, or internal or external risk factors.
−Removed: The CISO also issues an annual written report to the board of directors on the Program and material cybersecurity risks.
+Added: The results of the risk assessment and the proposed audit plan are communicated to various leaders within the Company as well as the audit committee of our board of directors for input.
+Added: The audit plan is reassessed throughout the year, and the plan is subject to modification by our internal audit team, e.g., based on such considerations as changes to resources, business operations, and internal or external risk factors.
+Added: The CISO also issues an annual written report to our board of directors on the Program and material cybersecurity risks.
The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents.
7 unchanged sentences
The Company’s information security team has extensive experience in information security and previous information security work experience in several industries, including defense, manufacturing, and financial services.
−Removed: The CISO reports to the board of directors, the audit committee, and senior management on cybersecurity threats.
+Added: The CISO reports to our board of directors and senior management on cybersecurity threats.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.