3 unchanged sentences
Enterprise risk management (ERM) is an integral part of our business processes and our ERM framework considers cybersecurity risk, alongside other company risks, as part of our overall risk assessment process.
−Removed: We follow an industry-leading
−Removed: National Institute of Standards and Technology cybersecurity framework (NIST CSF) and have developed a comprehensive information security program for assessing, identifying and managing cybersecurity risks that is designed to protect our systems and data from unauthorized access, use or other security impact.
+Added: We follow an industry-leading National Institute of Standards and Technology cybersecurity framework (NIST CSF) and have developed a comprehensive information security program for assessing, identifying and managing cybersecurity risks that is designed to protect our systems and data from unauthorized access, use or other security impact.
As part of our information security program, we continuously monitor and update our information technology networks and infrastructure.
We have dedicated internal legal, compliance and information security teams, and leverage consultants and third-party service providers to inform our understanding of the threat landscape and to identify, prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact.
−Removed: Our information security strategy focuses on complying with applicable data privacy and protection laws, maintaining the availability of our manufacturing operations, protecting data, detecting and responding to threats, building resiliency and providing a secure foundation for growth and innovation.
+Added: Additionally, we engage third-party professional security firms to perform periodic network and application penetration testing and cybersecurity maturity assessments.
+Added: We maintain a cyber risk assessment strategy to identify and mitigate risk, including risks arising from third-party providers.
+Added: We also evaluate the security of our third-party platforms against industry standards (including, for example, ISO 27001 certification and System and Organization Controls 2).
+Added: Our information security strategy
+Added: focuses on complying with applicable data privacy and protection laws, maintaining the availability of our manufacturing operations, protecting data, detecting and responding to threats, building resiliency and providing a secure foundation for growth and innovation.
We invest in industry standard security technology to protect the company’s data and business processes against risk of cybersecurity incidents.
3 unchanged sentences
We maintain a third-party cyber risk management process to review and monitor critical suppliers regularly for cybersecurity risk and prescribe remediation activities when necessary.
−Removed: We train our employees through annual security training, phishing simulations and regular communications about timely security topics to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential cybersecurity events.
+Added: We train our employees through annual security training (including separate trainings related to cybersecurity, AI, data privacy, records and information management), phishing simulations and regular communications about timely security topics to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential cybersecurity events.
+Added: We have specific executive-level information security training to inform leadership across the organization about the information security strategy and preparedness in the event of a security incident.
+Added: We also engage third-party cybersecurity experts to perform periodic operational table-top exercises with management to review, prepare for, and improve, the company’s incident response procedures.
+Added: Key takeaways from these exercises are reviewed with the Audit Committee.
We have a cross-functional crisis management team comprised of business unit and functional leaders and a crisis management plan that includes procedures for identifying, containing and responding to cybersecurity incidents.
−Removed: We engage third-party cybersecurity experts to conduct tabletop exercises with our executive leadership to enhance incident response preparedness.
Our cybersecurity risk management strategy includes the use of cybersecurity insurance that provides protection against certain potential losses arising from certain cybersecurity incidents;
however, such insurance may not insure us against all claims related to security breaches, cyberattacks and other related breaches.
−Removed: The company has previously experienced threats and breaches to its data and systems but has not experienced a breach that had a material impact on its operations or business and has not incurred any material breach-related expenses for the last three years that are reasonably likely to materially affect the company or its business strategy, results of operations or financial condition.
+Added: In the last three years, the company has not experienced an information security incident that has had a material impact on its business strategy, results of operations or financial condition.
However, as discussed in “Item 1A.
7 unchanged sentences
Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee.
−Removed: To fulfill its oversight responsibilities, the Audit Committee reviews the measures implemented by the company to identify and mitigate cybersecurity risks and receives quarterly updates from our CDTO and CISO on the information security program, including the status of significant cybersecurity incidences, the emerging threat landscape, and the status of projects to strengthen the company’s information security posture.
+Added: To fulfill its oversight responsibilities, the Audit Committee reviews the measures implemented by the company to identify and mitigate cybersecurity risks and receives quarterly updates from our CDTO and CISO on the information security program, including the status of significant cybersecurity incidents, the emerging threat landscape, and the status of projects to strengthen the company’s information security posture.
The Audit Committee regularly reports to the Board on cybersecurity matters.
3 unchanged sentences
Our CISO, who reports to the CDTO, oversees the dedicated information security team, which works in partnership with the company’s ERM team and corporate audit department as well as consultants as part of an overall internal controls process to monitor cybersecurity threats and prevent, detect, mitigate and remediate cybersecurity incidents.
−Removed: The CDTO has over 30 years of information technology experience, including serving in strategic planning, oversight and global operation of information systems and technology functions for
−Removed: companies in the consumer packaged goods industry.
−Removed: The CISO has over 25 years of information technology experience, including strategy, execution, and operations of enterprise-wide security programs, including cybersecurity programs, and global information technology infrastructure programs.
+Added: The CDTO has over 30 years of information technology experience, including serving in strategic planning, oversight and global operation of information systems and technology functions for companies in the consumer packaged goods industry.
+Added: The CISO has over 20 years of information technology and cybersecurity experience, including strategy, execution, architecture, and operations of enterprise-wide technology programs, including cybersecurity and global information technology infrastructure.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.