11 unchanged sentences
This is in addition to management’s periodic updates on cybersecurity incidents involving the Company or other industry and global participants.
−Removed: The Audit Committee also receives regular updates on the efficacy of our cybersecurity program and risk management from our chief information officer and other members of management that are tasked with monitoring cybersecurity risks.
+Added: The Audit Committee also receives quarterly updates on the efficacy of our cybersecurity program and risk management from our chief information officer and other members of management that are tasked with monitoring cybersecurity risks.
Our chief information officer has over 10 years of experience overseeing cybersecurity teams at both the Company and two other public companies.
Our chief information officer is supported by a dedicated team of certified cybersecurity professionals, with an average of over 13 years of relevant experience .
−Removed: Our cybersecurity strategy prioritizes governance, protection, detection, analysis, and response to known, anticipated, or unexpected cyber threats, effective management of cyber risks and resilience against cyber incidents.
+Added: Our cybersecurity strategy prioritizes governance, identification, protection, detection, analysis, response and recovery to known, anticipated, or unexpected cyber threats.
+Added: The strategy emphasizes effective management of cyber risks and resilience against cyber threats.
We maintain a formal cybersecurity program structured around the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), a voluntary framework created by industry and the U.S.
2 unchanged sentences
govern, identify, protect, detect, respond and recover.
−Removed: We consistently evaluate the threat landscape, adopting a multifaceted approach to cybersecurity risks that through a zero trust strategy focusing on prevention, detection, and mitigation, which includes the following programs and practices:
+Added: We consistently evaluate the threat landscape, utilizing a multifaceted approach to cybersecurity risks that through a zero trust strategy focuses on prevention, detection, and mitigation, which includes the following programs and practices:
• Our cybersecurity team conducts an annual review of cybersecurity risks at the ERM level, integrating significant cybersecurity risks into our overall ERM program.
−Removed: We remain committed to increasing investments in cybersecurity, which includes providing additional training for end-users, adopting a zero trust methodology, identifying and safeguarding critical assets, and reinforcing monitoring and alerting capabilities.
+Added: We remain committed to increasing investments in cybersecurity, which includes providing additional training for end-users, utilizing a zero trust methodology, identifying and safeguarding critical assets, and reinforcing monitoring and alerting capabilities.
Our proactive approach involves regular testing of defenses through simulations and penetration tests, both technically and through a comprehensive review of operational policies and procedures.
4 unchanged sentences
In addition, our standard terms and conditions with third-party service providers feature contractual provisions mandating specific security protections.
+Added: CF INDUSTRIES HOLDINGS, INC.
• Our cybersecurity incident response plan is designed to detect and address potential threats that may impact the confidentiality, integrity, and availability of our technology systems.
The response plan includes coordinated processes for handling security and data privacy incidents, encompassing communication and effective response, and as appropriate, escalation to the Audit Committee or the Board.
−Removed: CF INDUSTRIES HOLDINGS, INC.
• Our global business continuity program includes information technology disaster recovery, supporting resilience in both our business and information technology.
6 unchanged sentences
Business—Storage Facilities and Other Properties.
−Removed: LEGAL PROCEEDINGS.
−Removed: For information on pending proceedings relating to environmental remediation matters, see Item 1.
−Removed: Business—Environmental, Health and Safety—CERCLA/Remediation Matters.
−Removed: MINE SAFETY DISCLOSURES.
−Removed: Not applicable.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.