13 unchanged sentences
The key steps we have taken to detect, identify, classify and mitigate cybersecurity and privacy risks, include:
−Removed: • Adopting and periodically reviewing and updating information security and privacy policies and procedures and undergoing cyber-incident table top exercises;
−Removed: • Using network and system security tools aimed at detecting and mitigating unauthorized system and data access and cyber threats;
+Added: • Adopting and periodically reviewing and updating information security and privacy policies and procedures and undergoing cyber-incident tabletop exercises;
+Added: • An around the clock Security Operations Center that leverages network and system security tools aimed at detecting and mitigating unauthorized system and data access and cyber threats;
• Conducting targeted audits and penetration tests throughout the year, using both internal and external resources;
1 unchanged sentence
• Conducting cyber-maturity evaluations, including engaging an industry-leading, nationally-known third party to independently evaluate our information security maturity on a periodic basis;
−Removed: • Assessing cybersecurity risk profiles of our third-party service providers, including by partnering with key providers to ensure they have appropriate security measures to safeguard their information technology systems and including robust data security provisions in our contracts with third parties that handle our data;
+Added: • Assessing cybersecurity risk profiles of our third-party service providers, including partnering with key providers to ensure they have appropriate security measures to safeguard their information technology systems and including robust data security provisions in our contracts with third parties that handle our data;
• Providing annual security and privacy training and awareness to our employees to educate our employees on cybersecurity risks;
+Added: • Performing periodic cybersecurity incident simulations, conducted by an industry-leading third party incident response organization, with key information technology and business team members participating to ensure employees are familiar with process and procedures in the event of a cybersecurity incident;
• Conducting periodic phishing simulations to test our employees’ responses to suspicious emails and to inform targeted cyber awareness training.
Despite our efforts and the efforts of our third-party service providers to secure our and their IT systems, cybersecurity attacks and incidents have occurred in the past, and may continue to occur in the future.
−Removed: For additional information regarding the risks we face from cybersecurity and privacy incidents, see Item 1A Risk Factors - “Risks Related to Information Technology and Data Security.”
−Removed: Management is responsible for understanding and managing the risks that we face in our business, including relating to cybersecurity, and the Board of Directors is responsible for overseeing management’s overall approach to risk management.
−Removed: On at least an annual basis, as part of our risk assessment process, the Board reviews the Company’s major risks, including risks related to cybersecurity and global information systems, along with potential options for mitigating these risks.
−Removed: The Board is informed of these risks through regular reports from our Chief Executive Officer, Chief Financial Officer and Chief Operating Officer (CFO), General Counsel and Chief Sustainability Officer, and other key members of senior management.
−Removed: Although the Board as a whole is ultimately responsible for risk oversight, the Board uses its committees to assist in its risk oversight
+Added: For additional information regarding the risks we face from cybersecurity and privacy incidents, refer to Item 1A.
+Added: - “Risk Factors” - “Risks Related to Information Technology and Data Security.” As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.
+Added: Table of Content s
+Added: Management is responsible for understanding and managing the risks that we face in our business, including those related to cybersecurity, and the Board of Directors is responsible for overseeing management’s overall approach to risk management.
+Added: On at least an annual basis, as part of our risk assessment process, the Board of Directors reviews the Company’s major risks, including risks related to cybersecurity and global information systems, along with potential options for mitigating these risks.
+Added: The Board of Directors is informed of these risks through regular reports from our Chief Executive Officer, Chief Financial Officer and Chief Operating Officer, Chief Legal and Sustainability Officer, and other key members of senior management.
+Added: Although the Board of Directors as a whole is ultimately responsible for risk oversight, the Board of Directors uses its committees to assist in its risk oversight function.
The Audit Committee of our Board of Directors has primary oversight of management’s enterprise risk assessment and risk management policies and practices, business continuity planning and information systems infrastructure and cybersecurity risk.
−Removed: As a result, the Chair of the Audit Committee also provides periodic updates to the full Board on these matters as part of its committee reports.
−Removed: The Audit Committee generally receives quarterly cybersecurity and information systems infrastructure reports from our head of Global Cybersecurity and Compliance (Head of Cybersecurity) , who oversees a global team responsible for our cybersecurity infrastructure.
+Added: As a result, the Chair of the Audit Committee also provides periodic updates to the full Board of Directors on these matters as part of its committee reports.
+Added: The Audit Committee generally receives quarterly cybersecurity and information systems infrastructure reports from either our Chief Information Officer (CIO) or our head of Global Cybersecurity and Compliance (Head of Cybersecurity) , who reports to our CIO and oversees a global team responsible for our cybersecurity infrastructure.
These reports cover various cybersecurity and information technology matters, including material risks and threat trends, mitigation strategies, security incidents, the status of information technology and cybersecurity priorities and initiatives and other related matters of importance.
−Removed: The Audit Committee provides periodic updates on these topics to the full Board as necessary.
−Removed: In addition to the above, the Audit Committee, typically in the presence of the full Board, will review the results of the independent cyber-maturity evaluations described above, and from time to time participates in table top exercises or other cybersecurity training programs.
+Added: The Audit Committee provides periodic updates on these topics to the full Board of Directors as necessary.
+Added: In addition to the above, the Audit Committee, typically in the presence of the full Board of Directors, will review the results of the independent cyber-maturity evaluations described above, and from time to time participates in tabletop exercises or other cybersecurity training programs.
Our Head of Cybersecurity is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through our key cybersecurity processes, discussed above, and, together with other lead members of the incident response teams, is responsible for informing senior leadership across the organization about any cybersecurity incidents that may occur.
−Removed: As a result, in addition to the regular updates referenced above, the Audit Committee and the full Board of Directors would also be promptly informed by the CFO and General Counsel of cybersecurity incidents in accordance with our security incident response procedures, as well as provided ongoing updates from lead members of the incident response teams, including the Head of Cybersecurity, regarding any such incidents in accordance with our incident response plan.
−Removed: Our Head of Cybersecurity has over 15 years of experience managing and leading information technology and cybersecurity teams.
−Removed: Our Head of Cybersecurity reports to our CFO who reports to our Chief Executive Officer.
+Added: As a result, in addition to the regular updates referenced above, the Audit Committee and the full Board of Directors would also be promptly informed by the CFO/COO and Chief Legal and Sustainability Officer of cybersecurity incidents in accordance with our security incident response procedures, as well as provided ongoing updates from lead members of the incident response teams, including the Head of Cybersecurity, regarding any such incidents in accordance with our incident response plan.
+Added: Our Head of Cybersecurity has 20 years of experience managing and leading information technology and cybersecurity teams.
+Added: Table of Content s
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.