UNRESOLVED STAFF COMMENTS
+Added: CNDT 2025 Annual Report
CYBERSECURITY MATTERS
5 unchanged sentences
We devote significant resources to cybersecurity and cybersecurity risk management processes to adapt to the changing cybersecurity landscape and to respond to emerging threats.
−Removed: We maintain a cybersecurity risk management program to assess, identify, manage, mitigate, and respond to material risks from cybersecurity threats to both our corporate information technology environment and to customer-facing products.
+Added: We maintain a cybersecurity risk management program to assess, identify, manage, mitigate, and respond to material risks from cybersecurity threats to both our corporate information technology environment and customer-facing products.
These processes are integrated into our overall Enterprise Risk Management (“ERM”) program, which is designed to strengthen our risk management capabilities by developing and implementing a governance structure, risk management framework, and processes that enable the identification, assessment, monitoring, and management of risks.
1 unchanged sentence
Our corporate information technology environment aligns with the Center for Internet Security ("CIS") Critical Security Controls (“CSC”).
−Removed: Our systems that manage customer-facing products, where appropriate and contractually required, are certified/attested to applicable security standards, including, without limitation, National Institute of Standards and Technology ("NIST") (NIST Special Publication 800-53 rev 5 moderate baseline), Payment Card Industry Data Security Standard ("PCI-DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), International Organization for Standardization ("ISO"), and the International Electrotechnical Commission ("IEC") Standard (ISO/IEC 27001:2013 & ISO 9001:2015).
−Removed: Our policies and
−Removed: CNDT 2024 Annual Report
−Removed: procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats among employees, detect intrusions into our systems, and respond to cybersecurity incidents.
+Added: Our systems that manage customer-facing products, where appropriate and contractually required, are certified/attested to applicable security standards, including, without limitation, National Institute of Standards and Technology ("NIST") (NIST Special Publication 800-53 rev 5 moderate baseline), Payment Card Industry Data Security Standard ("PCI-DSS"), Health Insurance Portability and Accountability Act ("HIPAA"), International Organization for Standardization ("ISO"), the International Electrotechnical Commission ("IEC") Standard (ISO/IEC 27001:2013 & ISO 9001:2015), and Systems and Organization Controls ("SOC") 2 standards.
+Added: Our policies and procedures concerning cybersecurity matters include processes to safeguard our information systems, monitor these systems, protect the confidentiality and integrity of our data, train and raise awareness of cybersecurity threats among employees, detect intrusions into our systems, and respond to cybersecurity incidents.
As part of our overall risk management strategy, we leverage a defense in depth philosophy, which includes, but is not limited to, additional end-user training, layered technology defenses, identifying and protecting critical assets, strengthening monitoring and warning systems, and engaging industry and subject matter experts.
1 unchanged sentence
At the management level, our cybersecurity team regularly monitors alerts and meets to discuss industry threats, trends, and remediation tactics.
−Removed: The cybersecurity team also regularly prepares a cyber report that includes metrics and compliance performance, collects data on cybersecurity threats and risks and conducts an annual risk assessment, which it uses to assess and refine Conduent's overall security posture.
+Added: The cybersecurity team also regularly prepares a cyber update that includes metrics and compliance performance, incorporating data on cybersecurity threats and risks, which it uses to assess and refine Conduent's overall security posture.
Furthermore, we receive cybersecurity alerts and threat intelligence from our peers, government agencies, information sharing and analysis centers and cybersecurity associations, as well as conduct periodic external penetration tests and gap testing to assess our processes and procedures and the ever-changing threat landscape.
3 unchanged sentences
These systems are either developed by us or licensed from or maintained by third-party providers.
−Removed: We assess key third-party cybersecurity controls through a cybersecurity questionnaire, require the implementation of certain security controls in our contracts where applicable, monitor the third party, and maintain the ability to discontinue our engagement with a key vendor if its cybersecurity posture fails to meet pre-established standards.
+Added: We assess key third-party cybersecurity controls through a cybersecurity questionnaire, require the implementation of certain security controls in our
+Added: CNDT 2025 Annual Report
+Added: contracts where applicable, monitor the third party, and maintain the ability to discontinue our engagement with a key vendor if its cybersecurity posture fails to meet pre-established standards.
Our Board of Directors (the “Board”) maintains oversight responsibility for our ERM program.
3 unchanged sentences
The Risk Committee works with the CISO and the Company’s senior executives in reviewing the cybersecurity risks and strategy, provides guidance on the Company’s cybersecurity goals and objectives, and monitors the information it receives from management regarding the assessment and management of cybersecurity risk.
−Removed: The Risk Committee also conducts an annual review that includes a survey of enhancements to the Company’s defenses and a cyber trend report, as well as management’s progress in implementing the Company’s cybersecurity strategic roadmap and compliance initiatives.
+Added: The Risk Committee also conducts an annual review that includes a survey of enhancements to the Company’s defenses as well as management's progress in implementing the Company's cybersecurity strategic roadmap and compliance initiatives.
The Company’s CISO, a Certified Information Systems Professional with over 15 years of technical and cybersecurity leadership in large multinational organizations, reports to our Executive Vice President, Chief Information Officer and is responsible for assessing, implementing, and managing the Company’s cybersecurity risk management program, informing senior management regarding the prevention, detection, mitigation and remediation of cybersecurity incidents, as well as supervising such efforts.
−Removed: The CISO approves the cybersecurity policies and procedures, implementation of controls, monitoring and detection programs and employee training on cybersecurity risks.
+Added: The CISO approves cybersecurity policies and procedures, implementation of controls, monitoring and detection programs and employee training on cybersecurity risks.
The CISO also reports cybersecurity risks and strategies directly to executive leadership.
In addition, the Company has implemented an Incident Response Materiality Assessment Committee (“IRMAC”), which consists of members from the Senior Leadership Team and is responsible for assessing the materiality of a cybersecurity incident referred to it by the Cybersecurity Incident Response Team (“CSIRT”) .
−Removed: Procedures exist to
−Removed: CNDT 2024 Annual Report
−Removed: ensure the Risk Committee of the Board of Directors, and if appropriate, the full Board of Directors are notified about cybersecurity incidents being assessed by the IRMAC.
−Removed: As noted above, we face a number of cybersecurity risks in connection with our business and, from time to time, experience or are subject to a variety of cybersecurity incidents that arise during the ordinary course of our business.
−Removed: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of any known cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company.
−Removed: New information concerning any known cybersecurity incidents that have occurred prior to the date of this report, however, could change our current belief and could result in a material adverse effect on our business strategy, results of operations, reputation or financial condition.
+Added: Procedures exist to ensure the Risk Committee of the Board of Directors, and if appropriate, the full Board of Directors is notified about cybersecurity incidents being assessed by the IRMAC.
+Added: As noted above, we face a number of cybersecurity risks in connection with our business and, from time to time, experience or are subject to a variety of cybersecurity incidents that arise during the ordinary course of our business, such as the previously disclosed January 2025 Cyber Event (for additional information, refer to Management's Discussion and Analysis of Financial Condition and Results of Operation – “Cyber Event” in Part II, Item 7 to this 10-K and Note 15 – Contingencies and Litigation to our Consolidated Financial Statements of Part II, Item 8 to this 10-K).
+Added: As of the date of this report, apart from the January 2025 Cyber Event (for which we maintain a liability on the Consolidated Balance Sheet for our expected remaining cash outlay), we do not believe that any risks from cybersecurity threats, including because of any known cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, the Company.
+Added: New information discovered after the date of this report concerning any known cybersecurity incidents that have occurred prior to the date of this report, however, could change our current belief and could result in a material adverse effect on our business strategy, results of operations, reputation or financial condition.
In addition, future cybersecurity incidents could materially affect our strategy, results of operations, reputation or financial condition.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.