4 unchanged sentences
We believe security is at the center of any strong data privacy program and maintaining cyber-readiness and managing cybersecurity risk continue to be areas of critical focus for us.
−Removed: We have in place an enterprise risk management (ERM) program designed to identify and assess the greatest existing and emerging risks that could impact our business, including cybersecurity and data privacy risks.
−Removed: As a part of our ERM process, we have developed a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats.
+Added: We have in place a group-wide risk management process designed to identify and assess the greatest existing and emerging risks that could impact our business, including cybersecurity and data privacy risks.
+Added: As a part of our risk assessment process, we have developed a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats.
We follow widely-accepted security standards to help guide our decisions and minimize cybersecurity risks.
14 unchanged sentences
Despite our efforts and the efforts of our third-party service providers to secure our and their IT systems, cybersecurity attacks and incidents have occurred in the past, and may continue to occur in the future.
−Removed: For additional information regarding the risks we face from cybersecurity and privacy incidents, see Item 1A “Risk Factors—Risks Related to Information Technology and Data Security—Privacy breaches and other cyber security risks related to our business could negatively affect our reputation, credibility and business.”
+Added: For additional information regarding the risks we face from cybersecurity and privacy incidents, see Item 1A Risk Factors - “Risks Related to Information Technology and Data Security.”
Management is responsible for understanding and managing the risks that we face in our business, including relating to cybersecurity, and the Board of Directors is responsible for overseeing management’s overall approach to risk management.
−Removed: On at least an annual basis, as part of our ERM process, the Board reviews the Company’s major risks, including risks related to cybersecurity and global information systems, along with potential options for mitigating these risks.
+Added: On at least an annual basis, as part of our risk assessment process, the Board reviews the Company’s major risks, including risks related to cybersecurity and global information systems, along with potential options for mitigating these risks.
The Board is informed of these risks through regular reports from our Chief Executive Officer, Chief Financial Officer and Chief Operating Officer (CFO), General Counsel and Chief Sustainability Officer, and other key members of senior management.
−Removed: Although the Board as a whole is ultimately responsible for risk oversight, the Board uses its committees to assist in its risk oversight function.
−Removed: The Audit Committee of our Board of Directors has primary responsibility for operation of the ERM program and risk management, business continuity planning and information systems infrastructure and cybersecurity risk.
+Added: Although the Board as a whole is ultimately responsible for risk oversight, the Board uses its committees to assist in its risk oversight
+Added: The Audit Committee of our Board of Directors has primary oversight of management’s enterprise risk assessment and risk management policies and practices, business continuity planning and information systems infrastructure and cybersecurity risk.
As a result, the Chair of the Audit Committee also provides periodic updates to the full Board on these matters as part of its committee reports.
−Removed: The Audit Committee generally receives quarterly cybersecurity and information systems infrastructure reports from either our Chief Information Officer (CIO) or our head of Global Cybersecurity and Compliance (Head of Cybersecurity), who reports to our CIO, and who oversees a global team responsible for our cybersecurity infrastructure.
+Added: The Audit Committee generally receives quarterly cybersecurity and information systems infrastructure reports from our head of Global Cybersecurity and Compliance (Head of Cybersecurity) , who oversees a global team responsible for our cybersecurity infrastructure.
These reports cover various cybersecurity and information technology matters, including material risks and threat trends, mitigation strategies, security incidents, the status of information technology and cybersecurity priorities and initiatives and other related matters of importance.
4 unchanged sentences
Our Head of Cybersecurity has over 15 years of experience managing and leading information technology and cybersecurity teams.
−Removed: Subsequent to the end of our fiscal year, our CIO left the Company and, in the interim, our Head of Cybersecurity currently reports to our CFO who reports to our Chief Executive Officer.
+Added: Our Head of Cybersecurity reports to our CFO who reports to our Chief Executive Officer.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.