2 unchanged sentences
Cybersecurity risk management, including our processes for assessing, identifying and managing material risks from cybersecurity threats, is an integral part of our overall enterprise risk management (ERM) program.
−Removed: The ERM program includes an annual assessment process designed to identify risks, including those from cybersecurity threats, that could affect us and the achievement of our objectives;
−Removed: to understand, assess, and prioritize those risks;
−Removed: and to facilitate the implementation of risk management strategies and processes across the company that are responsive to the company’s risk profile, business strategies, and specific material risk exposures.
−Removed: The ERM program seeks to integrate consideration of risk and risk management into business decision-making throughout the company, including through the implementation of policies and procedures intended to ensure that necessary information with respect to material risks, including material risks from cybersecurity threats, is transmitted to senior executives and, as appropriate, to the Board of Directors (Board) or relevant committees.
−Removed: The Board regularly reviews and discusses with the key members of management responsible for management of risk the guidelines and policies governing the ERM process, the key risks identified in the ERM process, the likelihood of occurrence and the potential impact assigned to those risks by management, and the risk mitigation strategies in each instance.
−Removed: The Audit Committee of the Board provides oversight in connection with management’s cybersecurity efforts.
−Removed: The Audit Committee receives periodic reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to cybersecurity.
−Removed: The Audit Committee also receives regular reports on the efficacy of our cybersecurity risks and related policies and procedures from our chief information officer and other members of senior management who are tasked with monitoring cybersecurity risks.
−Removed: Our chief information officer oversees a dedicated team of certified cybersecurity professionals, with an average of over 12 years of relevant experience.
−Removed: Our cybersecurity strategy prioritizes protection, detection, analysis, and response to known, anticipated or unexpected cyber threats, effective management of cyber risks and resilience against cyber incidents.
+Added: The ERM program includes an annual assessment process designed to identify risks, including those from cybersecurity threats, that could affect achievement of our business, operations and strategic objectives and to understand, assess, and prioritize those risks.
+Added: The ERM program also intends to facilitate the implementation of risk management strategies and risk mitigation processes across the Company that are responsive to the Company’s risk profile, overall business strategies, and specific material risk exposures.
+Added: The ERM program seeks to integrate consideration of risk and risk management into business decision-making throughout the Company, including through the implementation of policies and procedures intended to ensure that necessary information with respect to material risks, including material risks from cybersecurity threats, is appropriately communicated to senior executives and the Board of Directors (Board) or relevant committees.
+Added: The Board regularly reviews and discusses with members of management responsible for risk management the guidelines and policies governing the ERM process.
+Added: This includes the key risks identified in the ERM process, the likelihood of occurrence and the potential impact assigned to those risks by management, in addition to the risk mitigation strategies in each instance.
+Added: The Audit Committee of the Board oversees management’s cybersecurity risk management efforts.
+Added: Our chief information officer oversees information technology, cybersecurity risk and efforts to prevent and mitigate such risks.
+Added: The Audit Committee receives periodic reports summarizing threat detection and mitigation plans, audits of internal controls, summaries of training activities and certification achievements, assessments of cybersecurity program effectiveness and reports on other cybersecurity priorities and initiatives.
+Added: This is in addition to management’s periodic updates on cybersecurity incidents involving the Company or other industry and global participants.
+Added: The Audit Committee also receives regular updates on the efficacy of our cybersecurity program and risk management from our chief information officer and other members of management that are tasked with monitoring cybersecurity risks.
+Added: Our chief information officer has over 10 years of experience overseeing cybersecurity teams at both the Company and two other public companies.
+Added: Our chief information officer is supported by a dedicated team of certified cybersecurity professionals, with an average of over 13 years of relevant experience .
+Added: Our cybersecurity strategy prioritizes governance, protection, detection, analysis, and response to known, anticipated, or unexpected cyber threats, effective management of cyber risks and resilience against cyber incidents.
We maintain a formal cybersecurity program structured around the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), a voluntary framework created by industry and the U.S.
government to promote the protection of our infrastructure from cybersecurity risks.
−Removed: We contract with an external auditing firm to assess our cybersecurity controls relative to industry peers using the NIST CSF, which has five functions:
−Removed: identify, protect, detect, respond and recover.
−Removed: We consistently evaluate the threat landscape, adopting a multifaceted approach to cybersecurity risks through a zero-trust strategy focusing on prevention, detection, and mitigation, which includes the following programs and practices:
+Added: We contract with an external auditing firm to assess our cybersecurity controls relative to industry peers using the NIST CSF, which has six functions:
+Added: govern, identify, protect, detect, respond and recover.
+Added: We consistently evaluate the threat landscape, adopting a multifaceted approach to cybersecurity risks that through a zero trust strategy focusing on prevention, detection, and mitigation, which includes the following programs and practices:
• Our cybersecurity team conducts an annual review of cybersecurity risks at the ERM level, integrating significant cybersecurity risks into our overall ERM program.
3 unchanged sentences
Additionally, we conduct periodic external penetration tests and maturity testing to assess the effectiveness of our security controls, including processes, procedures, and our readiness to face the evolving threat landscape.
−Removed: • We consider and assess the cybersecurity risks associated with the utilization of third-party service providers under our third-party risk management program.
+Added: • We consider and assess the cybersecurity risks associated with the utilization of third-party service providers, including cybersecurity vendors, consultants, and auditors, under our third-party risk management program.
Pursuant to the program, we evaluate security and data privacy controls prior to sharing or authorizing the hosting of sensitive data in computing environments managed by third parties.
1 unchanged sentence
• Our cybersecurity incident response plan is designed to detect and address potential threats that may impact the confidentiality, integrity, and availability of our technology systems.
−Removed: The response plan includes coordinated processes for handling security and data privacy incidents, encompassing communication and effective response.
−Removed: • Our global business continuity program includes information technology disaster recovery, supporting resilience in both our business and information technology.
−Removed: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect our business strategy, results
+Added: The response plan includes coordinated processes for handling security and data privacy incidents, encompassing communication and effective response, and as appropriate, escalation to the Audit Committee or the Board.
CF INDUSTRIES HOLDINGS, INC.
−Removed: of operations, or financial condition.
+Added: • Our global business continuity program includes information technology disaster recovery, supporting resilience in both our business and information technology.
+Added: To date, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition.
We cannot, however, eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident.
For more information about these risks, see the disclosure in Item 1A.
−Removed: Risk Factors under “Operational Risks—We are subject to risks relating to our information technology systems, and any technology disruption or cybersecurity incident could negatively affect our operations.”
+Added: Risk Factors under “Operational Risks—Failure, inadequacy, breach of, or unauthorized access to, our information technology systems or those of third-party service providers or customers could negatively affect our business and operations.”
Information regarding our facilities and properties is included in Item 1.
−Removed: Business—Nitrogen Manufacturing Facilities and Item 1.
+Added: Business—Manufacturing Facilities and Item 1.
Business—Storage Facilities and Other Properties.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.