9 unchanged sentences
Our CISO, who has over 39-years of industry experience, and his team, have relevant education and experience assessing and managing cybersecurity programs and cybersecurity risks across a mix of enterprises, including the retail industry.
−Removed: Together with a third-party, the CISO and his team also operate a 24/7 Security Operations Center to monitor the cybersecurity environment and coordinate escalation and remediation of alerts, and we incorporate many other resources to maintain readiness to withstand and respond to a cyber incident including but not limited to incident response tabletop exercises, system recovery exercises, simulated phishing email exercises and security awareness training.
+Added: Together with a third-party, the CISO and his team also operate a 24/7 Security Operations Center to monitor the cybersecurity environment and coordinate escalation and remediation of alerts, and we incorporate many other resources to maintain readiness to withstand and respond to a cyber or other data security incident including but not limited to incident response tabletop exercises, system recovery exercises, simulated phishing email exercises and security awareness training.
Our CISO and his team have also developed processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers who access our information technology systems, which includes leveraging our vendor risk management program designed to assess and manage the cybersecurity risks associated with these partnerships.
−Removed: As part of the program, our governance, risk and compliance team conducts due diligence as a part of onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.
−Removed: The Company has a Cybersecurity Incident Response Plan ("the Plan"), integrated into our enterprise crisis management and business continuity program, which provides protocols and procedures for evaluating and responding to material cybersecurity incidents, including incident handling, disclosure and reporting, notification to senior management, the Board and relevant committees, and meeting external reporting obligations.
−Removed: As part of the Plan, the Company has also established an Incident Response Governance Team, co-chaired by our CISO and VP, Deputy General Counsel, which is a cross-functional group comprised of relevant stakeholders throughout the organization responsible for organizing the assessment, investigation and response to any material cybersecurity event.
−Removed: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations.
+Added: As part of the program, our IT governance, risk and compliance team conduct due diligence as a part of onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.
+Added: The Company has a Cybersecurity Incident Response Plan ("the Plan"), which provides protocols and procedures for evaluating and responding to material cybersecurity and other data security incidents, including incident handling, disclosure and reporting, notification to senior management, the Board and relevant committees, and meeting external reporting obligations.
+Added: As part of the Plan, the Company has also established an Incident Response Governance Team, co-chaired by our CISO and VP, Deputy General Counsel, which is a cross-functional group comprised of relevant stakeholders throughout the organization responsible for organizing the assessment, investigation and response to any material cybersecurity or data security event.
+Added: As of the date of this report, no cybersecurity or data security incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations.
Notwithstanding the comprehensive approach we take to information security, there can be no assurance that our security efforts and measures, and those of our third-party service providers, will prevent or mitigate all incidents that could have a material adverse effect on our business, financial condition or results of operations.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.