6 unchanged sentences
Our global cybersecurity team has experience and expertise with potential cybersecurity threats and supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure.
−Removed: Our Director of Cybersecurity and Technology Risk Management has over a decade of experience leading cyber security oversight, and others on our global cybersecurity team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional, CompTIA, Offensive Security Certified Professional, Certificate of Cloud Security Knowledge, Global Information Assurance Certification, Certified Incident Handler certifications.
+Added: Our Chief Information Security Officer has over a decade of experience leading cyber-security oversight, and others on our global cybersecurity team have cybersecurity experience and certifications.
We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed.
All employees are required to complete cybersecurity trainings at least once a year and have access to more frequent cybersecurity trainings.
−Removed: We also require employees in certain roles to complete additional role-based, specialized
−Removed: cybersecurity trainings.
+Added: We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.
Program performance is reported to and monitored by senior leadership and the Audit Committee on a quarterly basis.
The Company maintains an Enterprise Risk Management (“ERM”) program, which includes processes for key risk identification, mitigation efforts, and day-to-day management of risks, including cybersecurity risks.
−Removed: The ERM program is administered by our Internal Audit department and involves our global cybersecurity team, which possesses significant knowledge and expertise in the area of cybersecurity risks.
+Added: The ERM program is administered by our Internal Audit department and involves our global cybersecurity team, which possesses knowledge and expertise in the area of cybersecurity risks.
Our global cybersecurity team helps ensure the cybersecurity risks identified from the ERM program are incorporated into our overall cybersecurity program.
5 unchanged sentences
Previous attacks on our operating systems have not had a material financial impact on our operations, but we cannot guarantee future attacks will have little to no impact on our business.
−Removed: Furthermore, given the interconnected nature of the supply chain and our significant presence in the industry, we believe we may be an attractive target for such attacks.
+Added: Furthermore, given the interconnected nature of the global supply chain and our significant presence in the industry, we believe we may be an attractive target for such attacks.
The impact of a cybersecurity incident may have a material adverse impact on our financial condition, results of operations, availability of our systems, and growth prospects, which makes cybersecurity risk management of critical importance to our organization.
10 unchanged sentences
These functions are also supported by internal compliance teams that perform additional layers of testing prior to SOC 2 Type 2 procedures.
−Removed: Our Technology Continuity program follows industry standards for disaster recovery practices, including close alignment with ISO 27031:2011 and the Disaster Recovery Institute International’s Professional Practices.
−Removed: Our program includes multiple components that act as an additional line of defense—among them are regular functional recovery and tabletop exercises;
−Removed: cybersecurity exercises;
−Removed: protected backups for critical data;
−Removed: recovery time objectives;
−Removed: and recovery point objectives, including achievability metrics, application criticality tiering, program audit and maintenance, awareness and training, business impact analysis, and risk evaluation and controls.
+Added: Our Technology Resilience program is aligned with industry standards for disaster recovery including the Disaster Recovery Institute International’s Professional Practices.
+Added: The program includes processes such as regular continuity and cybersecurity exercises, protected backups for critical data, defined recovery time and recovery point objectives with supporting achievability metrics, application criticality tiering, ongoing audits and maintenance, awareness and training initiatives, business impact analysis, and risk evaluation and control measures.
+Added: These measures are intended to mitigate the impact of potential disruptions but cannot eliminate all risks.
Cybersecurity Governance
1 unchanged sentence
The Audit Committee oversees our ERM program and receives semi-annual ERM updates, which include cyber-related risk items.
−Removed: In addition, our Audit Committee receives quarterly reports on cybersecurity from our Chief Technology Officer and our Director of Cybersecurity and Technology Risk Management .
−Removed: Our Director of Cybersecurity and Technology Risk Management and their global cybersecurity team has experience and expertise with potential cybersecurity threats and supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure.
−Removed: We have also established a cross-functional project team of subject matter experts from across the organization to quickly analyze, mitigate, and remediate potential cybersecurity incidents or vulnerabilities and comply with cybersecurity related
−Removed: reporting requirements.
+Added: In addition, our Audit Committee receives quarterly reports on cybersecurity from our Chief Technology Officer and our Chief Information Security Officer and Technology Risk Management .
+Added: Our Chief Information Security Officer
+Added: and Technology Risk Management and their global cybersecurity team has experience and expertise with potential cybersecurity threats and supporting mitigation of the potential cybersecurity threats facing our organization and vulnerabilities facing our technology infrastructure.
+Added: We have also established a cross-functional project team of subject matter experts from across the organization to quickly analyze, mitigate, and remediate potential cybersecurity incidents or vulnerabilities and comply with cybersecurity related reporting requirements.
The details of any such cybersecurity incidents or threats are included in the quarterly reports to the Audit Committee.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.