3 unchanged sentences
Cybersecurity is an important element of the Company’s overall enterprise risk management program.
−Removed: The Company has a multilayered system for assessing, identifying, and managing cybersecurity risks, designed to help protect the Company’s information assets and operations from internal and external cyber threats by understanding and seeking to manage risk while helping to support business resiliency and seeking to protect employee, guest, and franchisee information from unauthorized access or attack, as well as seeking to secure the Company’s networks, systems, devices, products, and services.
−Removed: Cybersecurity is incorporated into the Company’s enterprise risk management program through membership within and regular reporting to the Compliance and Enterprise Risk Management Committee.
−Removed: The Company devotes significant resources to helping protect and evolve the security of its computer systems, software, networks, and other technology assets, and the Company’s cybersecurity risk management program includes physical, administrative, and technical safeguards.
+Added: The Company has a multilayered system to assess, identify, and manage cybersecurity risks.
+Added: The system is designed to help protect the Company’s information assets and operations from internal and external cyber threats.
+Added: The system is used to understand and manage risks to help support business resiliency and to protect data subjects' information from unauthorized access or attack, as well as to secure the Company’s networks, systems, devices, products, and services.
+Added: Cybersecurity is incorporated into the Company’s enterprise risk management program through membership within and regular reporting to the Enterprise Risk Committee.
+Added: The Company devotes significant resources to help protect and evolve the security of its computer systems, software, networks, and other technology assets, and the Company’s cybersecurity risk management program includes physical, administrative, and technical safeguards.
The Company’s cybersecurity policies, standards, and procedures include data breach response plans, which are reviewed regularly.
−Removed: The Company is in the process of assessing its cybersecurity program and safeguards against the National Institute of Standards of Technology Cybersecurity Framework (the “Framework”).
+Added: The Company annually assesses its cybersecurity program and safeguards against the National Institute of Standards of Technology Cybersecurity Framework (the “Framework”).
The Company's cyber incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes intended to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations.
The Company endeavors to continually refine its policies and practices to help protect its platform, adapt to changes in regulations, identify potential and emerging security risks, and develop mitigations for those risks.
−Removed: For example, the Company seeks to conduct incident simulations and assessments annually to help discover potential vulnerabilities, with the objective of improving decision-making and prioritization and promoting monitoring and reporting across compliance functions.
+Added: For example, the Company seeks to conduct incident simulations and assessments annually to help discover potential vulnerabilities, with the objective to improve decision-making and prioritize and promote the monitoring and reporting across compliance functions.
As part of its overall risk mitigation strategy, the Company also maintains cyber insurance coverage.
1 unchanged sentence
For example, the Company’s independent assessor provides a periodic assessment of the Company’s risk posture to help identify threats as well as opportunities to enhance safeguards.
−Removed: Annually, the Company’s adherence to the Payment Card Industry Data Security Standard is assessed by an external party which includes one or more penetration tests of the Company’s technological environment.
+Added: Annually, the Company’s adherence to the Payment Card Industry Data Security Standard is assessed by an external party which includes one or more penetration tests of the Company’s applicable technological environment.
The Company has engaged an independent security assessor to evaluate the Company’s cybersecurity program against the Framework.
Additionally, the cybersecurity program is subject to regular assessment by internal audit and the Company's external auditors.
−Removed: The Company participates in the Retail & Hospitality
−Removed: Information Sharing and Analysis Center (“RH-ISAC”) where peer companies are engaged on industry trends and emerging threats, including those relating to cybersecurity.
+Added: The Company participates in the Retail & Hospitality Information Sharing and Analysis Center (“RH-ISAC”) where peer companies are engaged on industry trends and emerging threats, including those relating to cybersecurity.
To help oversee and identify risks from cybersecurity threats associated with the Company’s use of third-party service providers, the Company has a third-party information risk management program intended to minimize the likelihood of misuse of Choice data by third parties and business partners and requires that third-party service providers complete a periodic security risk assessment.
6 unchanged sentences
Cybersecurity updates are rotated quarterly between the Board of Directors and the Audit Committee.
−Removed: The reports generally focus on items such as risk reduction efforts, emerging and existing threats, training initiatives, the status of projects to strengthen cybersecurity, emerging regulatory policies and regulations, cybersecurity technologies and best practices, cyber readiness, results of third-party assessments, mitigation efforts, and response plans.
+Added: The reports generally focus on items such as risk reduction efforts, emerging and existing threats, training initiatives, the status of projects to strengthen cybersecurity, emerging security and privacy regulatory policies and regulations, cybersecurity technologies and best practices, cyber readiness, results of third-party assessments, mitigation efforts, and response plans.
The Company has a Chief Information Security Officer (“CISO”) whose team is responsible for leading company-wide cybersecurity strategy, policy, standards, and processes and works across all of the units of the Company to help protect the Company and its employees against cybersecurity risks.
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.