5 unchanged sentences
Cybersecurity Governance
−Removed: We are committed to protecting our Information Technology (IT) assets and the data stored within these assets.
−Removed: This commitment includes the protection of IT assets relevant to our operations, stakeholder data (including employee, customer and supplier data), intellectual property and our products.
−Removed: The Cummins Enterprise Cybersecurity function, which is responsible for the administration of our enterprise cybersecurity program, is led by the Chief Information Security Officer, who has more than 25 years of information technology, IT architecture and operations experience in the industrial manufacturing industry.
+Added: We are committed to protecting our IT assets and the data stored within these assets.
+Added: This commitment includes the protection of cyber assets relevant to our operations, stakeholder data (including employee, customer and supplier data), intellectual property and our products.
+Added: The Enterprise Cybersecurity function, which is responsible for the administration of our enterprise cybersecurity program, is led by the Chief Information Security Officer, who holds a degree in Management Information Systems (MIS) and a Certified Information Security Manager (CISM) designation, and has more than 20 years of IT, cybersecurity, audit and risk management experience in the industrial manufacturing industry.
The Chief Information Security Officer reports to our Chief Information Officer.
These leaders provide regular updates to the Audit Committee of the Board on cybersecurity risks.
−Removed: Through these updates, the Audit Committee receives a cybersecurity dashboard illustrating the status of key cybersecurity activities such as email phishing, event logging and data encryption.
−Removed: Information regarding relevant cybersecurity training is provided as well.
−Removed: The Product Cybersecurity function, which is responsible for the administration of our product cybersecurity program, is led by the Executive Director – Corporate Product Cybersecurity and Functional Safety, who has more than 35 years of automotive industry and electronic controls design experience.
−Removed: The Executive Director – Corporate Product Cybersecurity and Functional Safety reports to our Chief Technical Officer.
+Added: Through these updates, the Audit Committee receives a cybersecurity dashboard illustrating cybersecurity priorities and the status of key initiatives.
+Added: The Product Cybersecurity function, which is responsible for the administration of our product cybersecurity program, is led by the Principal Engineer – Product Cybersecurity, who has more than 35 years of embedded electronic systems design experience.
+Added: The Principal Engineer – Product Cybersecurity works directly with the Chief Technical Officer.
These leaders provide regular updates to the SET Committee of the Board on product related cybersecurity risks.
1 unchanged sentence
Our processes for oversight of cybersecurity risks are integrated into our Enterprise Risk Management (ERM) program , which is led by the Executive Director, Global Risk.
−Removed: To govern the ERM program, we established an Executive Risk Council that meets regularly to review and monitor our most significant enterprise risks, including the prevention, detection and mitigation plans, including with respect to cybersecurity.
+Added: To govern the ERM program, we established an Executive Risk Council that meets regularly to review and monitor our most significant enterprise risks, and our prevention, detection and mitigation plans, including with respect to cybersecurity.
The Executive Risk Council is comprised of senior leaders with cross-functional experience and responsibilities.
4 unchanged sentences
Our Board, Audit Committee and SET Committee receive reports and information from our senior leaders who have functional responsibility for the mitigation of enterprise cybersecurity and product cybersecurity risks.
−Removed: These leaders meet with the committees on a regular basis, at least four times per year, and provide dashboards or reports, which summarize cybersecurity risks and action plans.
+Added: These leaders meet with the committees on a regular basis and provide dashboards or reports, which summarize cybersecurity risks and action plans.
+Added: The committees elevate matters to the Board as appropriate.
Cybersecurity Risk Management and Strategy
1 unchanged sentence
The Enterprise Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities.
−Removed: This MRG meets regularly, at least four times per year, with our Chief Information Security Officer to review the cybersecurity program and related risks.
+Added: This MRG meets regularly with our Chief Information Security Officer to review the enterprise cybersecurity program and related risks.
The MRG receives updates on the status of key cybersecurity initiatives and is responsible for our response to material cybersecurity incidents.
+Added: For material cybersecurity incidents, our process is to escalate through the MRG to the Audit Committee and Board.
We have a Product Cybersecurity Management Review Group (Product Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the product cybersecurity program.
The Product Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities.
−Removed: The Product Cybersecurity MRG meets regularly with the Executive Director – Corporate Product Cybersecurity and Functional Safety to review the cybersecurity program, including risks and the status of key initiatives.
+Added: The Product Cybersecurity MRG meets regularly with the Principal Engineer – Product Cybersecurity to review the product cybersecurity program, including risks and the status of key initiatives.
Both the Enterprise and Product Cybersecurity functions administer policies related to cybersecurity in consultation with other stakeholders at the company.
−Removed: We have a third-party risk management process, which is designed to assess and manage cybersecurity risks posed by third parties.
−Removed: This process is administered by the Enterprise Cybersecurity function.
−Removed: In addition, a cybersecurity operations team is in place, which monitors the environment for cybersecurity incidents on a regular basis.
+Added: Our risk-based cybersecurity program is designed to protect, detect, and respond to cybersecurity threats and incidents.
+Added: This program, developed alongside the National Institute of Standards and Technology Cybersecurity Framework, aims to protect the confidentiality, integrity, and availability of our IT assets and the data stored thereon.
+Added: We also have a third-party risk management process, which is designed to assess and manage cybersecurity risks posed by third parties.
+Added: This process is administered by the Enterprise Cybersecurity function, and through this program, the company evaluates the type of data that is shared with certain vendors with the goal of conducting risk-informed assessments.
+Added: These assessments provide insights which the Enterprise Cybersecurity function uses to better manage third-party risks.
+Added: A cybersecurity operations team is in place to regularly monitor the environment for cybersecurity threats and incidents.
We have incident response plans to assess and manage cybersecurity incidents.
1 unchanged sentence
The most critical incidents, which could be material to us, are escalated to executive management and the Enterprise Cybersecurity MRG.
−Removed: The Enterprise Cybersecurity MRG practices the incident response process through a tabletop exercise facilitated by external consultants.
In addition, cyber insurance is in place, which may mitigate the impact of cybersecurity incidents.
−Removed: We engage outside experts where appropriate to aid in developing and implementing the cybersecurity program and to review its operations.
−Removed: Our Internal Audit function also performs regular assessments of the design and operational effectiveness of the program’s key processes and controls.
−Removed: We will continue to enhance our cybersecurity operations to respond to the dynamic cybersecurity landscape.
+Added: We engage outside experts where appropriate to aid in maturing, implementing and testing the cybersecurity program and to review our cybersecurity operations.
+Added: This includes incident response testing through tabletop exercises facilitated by external consultants.
+Added: We have implemented training and awareness programs to educate our employees on cybersecurity risks, which includes regular educational phishing campaigns, and our Internal Audit function performs regular assessments of the design and operational effectiveness of the program’s key processes and controls.
+Added: We will continue to develop and mature our cybersecurity operations to respond to the dynamic cybersecurity landscape.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.