3 unchanged sentences
We integrate cybersecurity into our top-level enterprise risk management (“ERM”) processes and our site-level operational risk management (“ORM”) processes, including management of operational technology (“OT”) cybersecurity risks.
−Removed: This involves, in part, direct engagement by, and consultation with, our Senior Director of Cybersecurity and IT Infrastructure (“Senior Director”) during ERM and ORM risk assessments, and collaboration between the Senior Director and relevant Operations employees regarding OT cybersecurity.
+Added: This involves, in part, direct engagement by, and consultation with, our Vice President, IT & Cybersecurity (“Vice President”) during ERM and ORM risk assessments, and collaboration between the Vice President and relevant Operations employees regarding OT cybersecurity.
Our cybersecurity strategy leverages people, processes, and technology to identify and manage cybersecurity risks, including through:
9 unchanged sentences
Our CSIRP is reviewed at least annually, and we conduct cybersecurity tabletop exercises to practice our response.
−Removed: Our Senior Director leads our internal team responsible for assessing and managing cybersecurity risks.
−Removed: The Senior Director has more than 10 years of experience being responsible for cybersecurity at multi-site industrial companies, in addition to IT infrastructure and strategy, and has earned the Global Information Assurance Certification (“GIAC”) Critical Controls, Defensible Security Architecture, Security Leadership, Security Operations, and Strategic Planning, Policy and Leadership certifications, as well as a Cybersecurity Management degree from the SANS Technology Institute.
−Removed: The Senior Director reports directly to the General Counsel and regularly engages with and briefs other members of senior and executive management on cybersecurity issues.
−Removed: A number of IT professionals with experience implementing cybersecurity defenses and responding to cyber attacks report to the Senior Director and, as noted above, the Senior Director also oversees third-party firms specializing in security monitoring and vulnerability assessment.
+Added: Our Vice President leads our internal team responsible for assessing and managing cybersecurity risks.
+Added: The Vice President has more than 10 years of experience being responsible for cybersecurity at multi-site industrial companies, in addition to IT infrastructure and strategy, and has earned the Global Information Assurance Certification (“GIAC”) Critical Controls, Defensible Security Architecture, Security Leadership, Security Operations, and Strategic Planning, Policy and Leadership certifications, as well as a Cybersecurity Management degree from the SANS Technology Institute.
+Added: The Vice President reports directly to the Senior Vice President, FP&A, Strategy and Performance and regularly engages with and briefs other members of senior and executive management on cybersecurity issues.
+Added: A number of IT professionals with experience implementing cybersecurity defenses and responding to cyber attacks report to the Vice President and, as noted above, the Vice President also oversees third-party firms specializing in security monitoring and vulnerability assessment.
Our Board, with the assistance of the Audit Committee, to whom the Board has delegated to the primary authority and responsibility to oversee cybersecurity risks, oversees the management of risks arising from cybersecurity incidents, and, as noted above, cybersecurity is one of the material risks tracked through our ERM process.
−Removed: The Audit Committee is briefed quarterly by our Senior Director on cybersecurity emerging risks, strategies, key initiatives, incidents and training and compliance.
+Added: The Audit Committee is briefed quarterly by our Vice President on cybersecurity emerging risks, strategies, key initiatives, incidents and training and compliance.
Executive management and other senior leaders participate in the semi-annual updates to our ERM risk register and heat map, and those updates, which incorporate cybersecurity risk and strategy, also are presented to our Board for discussion and feedback at least annually.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.