10 unchanged sentences
Our cybersecurity efforts also include mandatory information security awareness training for all employees, clearly defined expectations for acceptable use policies, and certification of adherence to a code of conduct.
−Removed: The IT Governance, Risk, and Compliance (“IT GRC”) team conducts periodic audits to evaluate policy and regulatory compliance, recording findings for subsequent review and remediation initiatives.
+Added: The IT Governance, Risk, and Compliance team conducts periodic audits to evaluate policy and regulatory compliance, recording findings for subsequent review and remediation initiatives.
We also leverage internal and external security subject matter experts to conduct comprehensive risk assessments, including architecture reviews, vulnerability scans, penetration tests, application security evaluations, and technical compliance reviews.
5 unchanged sentences
The Board of Directors , acting directly and through its committees, is responsible for the oversight of our risk management programs.
−Removed: The Board’s Risk & Sustainability Committee has the delegated responsibility for the oversight of key enterprise risks, including risks from cybersecurity threats.
+Added: The Board’s Audit Committee has the delegated responsibility for the oversight of key enterprise risks, including risks from cybersecurity threats.
The committee also provides oversight of our policies and processes for monitoring and mitigating such risks.
−Removed: Among other duties, the Risk & Sustainability Committee receives and reviews periodic reports from management pertaining to cybersecurity programs and data protection controls, as well as other information security reports that the committee deems appropriate.
−Removed: The committee meets at least quarterly, and the chair of the committee gives regular reports to the Audit Committee and the full Board of Directors on its activities.
+Added: Among other duties, the Audit Committee receives and reviews periodic reports from management pertaining to cybersecurity programs and data protection controls, as well as other information security reports that the committee deems appropriate.
+Added: The committee meets at least quarterly, and the chair of the committee gives regular reports to the full Board of Directors on its activities.
Management is responsible for day-to-day risk management activities , including those relating to information systems and cybersecurity.
1 unchanged sentence
Our CISO and his team of certified security subject matter experts (collectively, “Information Security”) have deep experience and expertise in cybersecurity and lead our organizational efforts to assess and manage material risks associated with our information systems and cybersecurity threats.
−Removed: Our dedicated Information Security Steering Committee regularly reviews our most significant information security risks, strategic projects, and KPIs.
+Added: Our dedicated Information Security Steering Committee regularly reviews our most significant information security risks, strategic projects, and key performance indicators.
On a quarterly basis, Information Security also meets with business segment leadership to discuss the most significant risks, including identifying potentially material risks and developing, implementing, and applying reasonable risk mitigation processes.
Our risk management programs are developed, implemented, managed, and reviewed at the direction of Information Security and business segment leaders, with subsequent actions determined based on the results of these preventive and detective controls.
−Removed: We have implemented incident response procedures that define our approach when potential security incidents are identified, with clear definition of the escalation path, including when notification to the Risk & Sustainability Committee is required.
−Removed: Depending on the assessed severity of the incident, the Risk & Sustainability Committee may be notified immediately or at its next regularly scheduled meeting.
−Removed: Our corporate headquarters is located in the leased premises located at 70 St.
−Removed: Mary Axe, London EC3A 8BE, United Kingdom.
−Removed: We lease office facilities at 56 locations;
−Removed: 24 are in the U.S.
−Removed: We believe that our facilities, generally used across each of our segments, are well maintained and are suitable and adequate for our current needs.
+Added: We have implemented incident response procedures that define our approach when potential security incidents are identified, with clear definition of the escalation path, including when notification to the Audit Committee is required.
+Added: Depending on the assessed severity of the incident, the Audit Committee may be notified immediately or at its next regularly scheduled meeting.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.