1 unchanged sentence
CYBERSECURITY MATTERS
−Removed: As a leader in business process solutions, we leverage cloud computing, artificial intelligence, machine learning, automation and advanced analytics, our systems and information technology, and that of our third-party providers, and our interfaces with our customers are critical to our business, operating results, growth, prospects and reputation.
+Added: As a leader in business process solutions, we leverage cloud computing, AI, machine learning, automation and advanced analytics, our systems and information technology, and that of our third-party providers, and our interfaces with our customers are critical to our business, operating results, growth, prospects and reputation.
We act as a trusted business partner in providing both front-office and back-office platforms.
4 unchanged sentences
We maintain a cybersecurity risk management program to assess, identify, manage, mitigate, and respond to material risks from cybersecurity threats to both our corporate information technology environment and to customer-facing products.
−Removed: This program is integrated into our overall Enterprise Risk Management (“ERM”) program, which is designed to strengthen our risk management capabilities by developing and implementing a governance structure, risk management framework, and processes that enable the identification, assessment, monitoring and management of risks.
+Added: These processes are integrated into our overall Enterprise Risk Management (“ERM”) program, which is designed to strengthen our risk management capabilities by developing and implementing a governance structure, risk management framework, and processes that enable the identification, assessment, monitoring, and management of risks.
The underlying controls of our cybersecurity risk management program are based upon industry standards for cybersecurity and information technology.
−Removed: Our corporate information technology environment aligns with Center for Internet Security Critical Security Controls (“CIS CSC”).
−Removed: Our systems that manage customer-facing products, where appropriate and contractually required, are certified/attested to applicable security standards, including, without limitation, National Institute of Standards and Technology's publication (NIST 800-53 rev 5 moderate baseline), Payment Card Industry Data Security Standard ("PCI-DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), International Organization for Standardization ("ISO") and, the International Electrotechnical Commission ("IEC") Standard (ISO/IEC 27001:2013 & ISO 9001:2015).
−Removed: Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats among employees, detect intrusions into our systems and respond to cybersecurity incidents.
+Added: Our corporate information technology environment aligns with the Center for Internet Security ("CIS") Critical Security Controls (“CSC”).
+Added: Our systems that manage customer-facing products, where appropriate and contractually required, are certified/attested to applicable security standards, including, without limitation, National Institute of Standards and Technology ("NIST") (NIST Special Publication 800-53 rev 5 moderate baseline), Payment Card Industry Data Security Standard ("PCI-DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), International Organization for Standardization ("ISO"), and the International Electrotechnical Commission ("IEC") Standard (ISO/IEC 27001:2013 & ISO 9001:2015).
+Added: Our policies and
+Added: CNDT 2024 Annual Report
+Added: procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats among employees, detect intrusions into our systems, and respond to cybersecurity incidents.
As part of our overall risk management strategy, we leverage a defense in depth philosophy, which includes, but is not limited to, additional end-user training, layered technology defenses, identifying and protecting critical assets, strengthening monitoring and warning systems, and engaging industry and subject matter experts.
4 unchanged sentences
We have created and continually update, as required, a detailed incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification, and which we implement in the event of a cybersecurity incident.
−Removed: We also engage third parties and cybersecurity consultants on a regular basis to assess, test, and assist with the implementation of our risk management strategies, policies and procedures to enhance our detection, response and management of cybersecurity risks and compliance frameworks, including but not limited to, consultants who assist with risk assessment, assist with our PCI-DSS compliance assessments, assess our systems’ alignment with the NIST Cybersecurity Framework, ensuring adherence to ISO audits.
−Removed: CNDT 2023 Annual Report
+Added: We also engage third parties and cybersecurity consultants on a regular basis to assess, test, and assist with the implementation of our risk management strategies, policies and procedures to enhance our detection, response and management of cybersecurity risks and compliance frameworks, including but not limited to, consultants who assist with risk assessment, third parties who assist with our PCI-DSS compliance assessments, and auditors who audit our systems to ensure adherence to the relevant standard under evaluation.
We rely on a variety of security software, including cloud-based technology to scan and analyze for vulnerable software or misconfigurations, for our operations and our business processing solutions.
These systems are either developed by us or licensed from or maintained by third-party providers.
−Removed: We assess key third-party cybersecurity controls through a cybersecurity questionnaire, require the implementation of certain security controls in our contracts where applicable, maintain continuous monitoring during the engagement of the third party, and maintain the ability to discontinue our engagement with a key vendor if its cybersecurity posture fails to meet pre-established standards.
+Added: We assess key third-party cybersecurity controls through a cybersecurity questionnaire, require the implementation of certain security controls in our contracts where applicable, monitor the third party, and maintain the ability to discontinue our engagement with a key vendor if its cybersecurity posture fails to meet pre-established standards.
Our Board of Directors (the “Board”) maintains oversight responsibility for our ERM program.
7 unchanged sentences
The CISO also reports cybersecurity risks and strategies directly to executive leadership.
−Removed: As noted above, we face a number of cybersecurity risks in connection with our business and, from time to time, experience or are subject to a variety of cybersecurity incidents that arise during the ordinary course of its business.
−Removed: We do not believe that any incidents that have occurred prior to the date of this report have had or will have a material adverse effect on our business strategy, results of operations, reputation or financial position.
−Removed: Future cybersecurity incidents could, however, materially affect our strategy, results of operations, reputation or financial condition.
+Added: In addition, the Company has implemented an Incident Response Materiality Assessment Committee (“IRMAC”), which consists of members from the Senior Leadership Team and is responsible for assessing the materiality of a cybersecurity incident referred to it by the Cybersecurity Incident Response Team (“CSIRT”) .
+Added: Procedures exist to
+Added: CNDT 2024 Annual Report
+Added: ensure the Risk Committee of the Board of Directors, and if appropriate, the full Board of Directors are notified about cybersecurity incidents being assessed by the IRMAC.
+Added: As noted above, we face a number of cybersecurity risks in connection with our business and, from time to time, experience or are subject to a variety of cybersecurity incidents that arise during the ordinary course of our business.
+Added: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any known cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company.
+Added: New information concerning any known cybersecurity incidents that have occurred prior to the date of this report, however, could change our current belief and could result in a material adverse effect on our business strategy, results of operations, reputation or financial condition.
+Added: In addition, future cybersecurity incidents could materially affect our strategy, results of operations, reputation or financial condition.
Risk Factors for additional information on how risks could materially affect the Company.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.