3 unchanged sentences
Our global reach and the ever-evolving threat landscape makes data security and privacy a critical priority for us.
−Removed: Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team reports to our Chief Technology Officer and together, they are responsible for our network security, cybersecurity risk management processes, and business continuity.
−Removed: This team partners with leaders from all of our global regions to align our cybersecurity risk management processes and strategic goals with our business priorities and to ultimately mitigate cybersecurity risk at C.H.
−Removed: Our global cybersecurity team has experience and expertise supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure and potential cybersecurity threats.
−Removed: Our Director of Cybersecurity and Technology Risk Management has over a decade of experience leading cyber security oversight, and others on our global cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional, CompTIA, Offensive Security Certified Professional, Certificate of Cloud Security Knowledge, Global Information Assurance Certification (“GIAC”), Certified Incident Handler certifications.
+Added: Our Chief Information Security Officer and their global cybersecurity team reports to our Chief Technology Officer and together, they are responsible for our network security, cybersecurity risk management processes, and business continuity.
+Added: This team partners with leaders from all our global regions to align our cybersecurity risk management processes and strategic goals with our business priorities and ultimately mitigate cybersecurity risk at C.H.
+Added: Our global cybersecurity team has experience and expertise with potential cybersecurity threats and supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure.
+Added: Our Director of Cybersecurity and Technology Risk Management has over a decade of experience leading cyber security oversight, and others on our global cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional, CompTIA, Offensive Security Certified Professional, Certificate of Cloud Security Knowledge, Global Information Assurance Certification, Certified Incident Handler certifications.
We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed.
All employees are required to complete cybersecurity trainings at least once a year and have access to more frequent cybersecurity trainings.
−Removed: We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.
+Added: We also require employees in certain roles to complete additional role-based, specialized
+Added: cybersecurity trainings.
Program performance is reported to and monitored by senior leadership and the Audit Committee on a quarterly basis.
1 unchanged sentence
The ERM program is administered by our Internal Audit department and involves our global cybersecurity team, which possesses significant knowledge and expertise in the area of cybersecurity risks.
−Removed: Our global cybersecurity team ensures the cybersecurity risks identified from the ERM program are incorporated into our overall cybersecurity program.
+Added: Our global cybersecurity team helps ensure the cybersecurity risks identified from the ERM program are incorporated into our overall cybersecurity program.
Programs to address key cybersecurity risks have been put into place including layered coverage with focus areas and practices designed to address network and endpoint security, application security, and security operations.
1 unchanged sentence
Our security operations center serves as the front line of these alerts and investigates and remediates threats as necessary.
+Added: We also perform regular vulnerability assessments and penetration tests.
Although it is difficult to determine the potential impacts from a cybersecurity incident, we may experience negative impacts such as reputational harm, inability to retain existing customers or attract new customers, exposure to legal claims and government action, among others.
12 unchanged sentences
In addition, we submit to independent assessments by external parties, including System and Organizational Controls (“SOC”) 2 Type 2 audits, covering customer-facing and line-of-business applications to ensure all safeguards function as they should.
−Removed: These functions are also supported by internal compliance teams who perform additional layers of testing prior to SOC 2 Type 2 procedures.
+Added: These functions are also supported by internal compliance teams that perform additional layers of testing prior to SOC 2 Type 2 procedures.
Our Technology Continuity program follows industry standards for disaster recovery practices, including close alignment with ISO 27031:2011 and the Disaster Recovery Institute International’s Professional Practices.
8 unchanged sentences
In addition, our Audit Committee receives quarterly reports on cybersecurity from our Chief Technology Officer and our Director of Cybersecurity and Technology Risk Management .
−Removed: Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team has experience and expertise supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure and potential cybersecurity threats.
−Removed: We have also established a cross-functional project team of subject matter experts from across the organization to quickly analyze, mitigate, and remediate potential cybersecurity incidents or vulnerabilities and comply with cybersecurity related reporting requirements.
+Added: Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team has experience and expertise with potential cybersecurity threats and supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure.
+Added: We have also established a cross-functional project team of subject matter experts from across the organization to quickly analyze, mitigate, and remediate potential cybersecurity incidents or vulnerabilities and comply with cybersecurity related
+Added: reporting requirements.
The details of any such cybersecurity incidents or threats are included in the quarterly reports to the Audit Committee.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.