2 unchanged sentences
Cybersecurity Program and Management Oversight
−Removed: The Company has established an Information and Cybersecurity program.
+Added: The Company has established an Information and Cybersecurity program integrated into its risk management process.
The program is directed by the Company’s Information Security Strategy Board (“ISSB”).
43 unchanged sentences
The Company’s Information Security program balances security risks with business goals and provides appropriate protections for the confidentiality, integrity and availability of Company and customer information.
−Removed: The Company conducts benchmark reports of its Information Security program to assess its strength as measured against recommended industry security best practice entities.
+Added: The Company conducts benchmark assessments of its Information Security program to evaluate its strength as measured against recommended industry security best practice entities.
The Company has a process to prioritize and manage security related projects.
32 unchanged sentences
As new threats and vulnerabilities emerge that threaten its systems and data, the Company continues to evaluate and address these threats through a layered security approach.
+Added: The Company engages cybersecurity assessors and consultants, including third party auditors, to perform annual penetration testing and risk assessments.
+Added: These external parties provide validation of our processes and controls, ensuring they meet industry best practices and regulatory standards.
The Company performs network and application penetration testing on external high-risk applications as well as network penetration testing across its production, test, and disaster recovery networks.
10 unchanged sentences
This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks.
−Removed: The Company also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud.
+Added: The Company also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud.
While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on the Company, risk to its systems remains significant.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.