12 unchanged sentences
This policy is reviewed at least annually by the Company’s IT Security & Risk team, with updates approved by the Board of Directors.
−Removed: The Information Security Policy addresses the standards, design, scope, testing, and operation of the
−Removed: Company’s cybersecurity program.
+Added: The Information Security Policy addresses the standards, design, scope, testing, and operation of the Company’s cybersecurity program.
All Company employees are trained both initially and on an annual basis on the information security requirements set by the policy.
25 unchanged sentences
The CISO and CIO provide monthly updates to the Executive IT Council on security incidents, compliance and patching metrics, as well as security related industry updates that might affect the Company’s business.
+Added: Real time updates are also provided to the Executive IT Council as needed.
The Executive IT Council approves all security related project expenditures and all members are a part of the Company’s incident response team.
The Audit and Risk Committee, together with the full Board of Directors, actively oversees the Company’s cybersecurity program.
−Removed: The Audit and Risk Committee receives reports on evolving cybersecurity standards and key metrics, including the number of incidents, response times, and effectiveness of safety controls, from the CIO on a quarterly basis, and more
−Removed: frequently when necessary.
+Added: The Audit and Risk Committee receives reports on evolving cybersecurity standards and key metrics, including the number of incidents, response times, and effectiveness of safety controls from the CIO on a quarterly basis, and more frequently when necessary.
These reports include updates on the activities of the Executive IT Council.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.