6 unchanged sentences
We engage independent third-parties to conduct ethical hacks of key systems, aiding our understanding of control effectiveness and facilitating the implementation of more robust controls.
−Removed: We periodically engage with a third-party assessment firm to conduct reviews of our overall program and to examine our security controls to help us better align our cybersecurity program with industry standards.
+Added: We periodically engage with a third-party assessment firm to conduct reviews of our overall program and to examine our security controls to help us better align our cybersecurity
+Added: program with industry standards.
To monitor and decrease the risks from cybersecurity threats associated with our use of third-party service providers , potential new vendors with a greater degree of system or data access are subjected to a security vetting process prior to engagement.
−Removed: Existing critical vendors that store or process company or client information are reviewed annually through commercially reasonable efforts.
+Added: Existing critical vendors that store or process company or client information are reviewed annually through commercially reasonable efforts such as questionnaires.
Management and Board Oversight
−Removed: Our management is responsible for the day-to-day management of the risks that we face, while our Board of Directors, as a whole, has responsibility for the oversight of our enterprise risk management.
−Removed: Under the oversight of the Board of Directors, cybersecurity risk is managed under the direction of our Information Security department, the ISC and the Enterprise Risk Committee (“ERC”).
+Added: Our management is responsible for the day-to-day management of the risks that we face, while our Board of Directors , as a whole, has responsibility for the oversight of our enterprise risk management, including cybersecurity.
+Added: Under the oversight of the Board of Directors, cybersecurity risk is managed under the direction of our Information Security department, the Information Security Council ("ISC") and the Enterprise Risk Committee (“ERC”).
The ISC is a standing committee that acts as a point of escalation for security incidents and is headed by our Chief Information Officer (“CIO”) .
−Removed: Our CIO has over 20 years of experience in the IT field, holds a Bachelor of Science in Information Systems and is MCSE certified.
+Added: Our CIO has over 20 years of experience in the IT field, holds a Bachelor of Science in Information Systems and is Microsoft Certified Solutions Expert (MCSE) certified.
Other members of the ISC include IT senior leadership, IT operations and corporate management and a member from our Forensic & Cyber Investigations practice.
9 unchanged sentences
Once a potential cybersecurity incident is identified, IT personnel assigned to the incident assess the severity of the event and sensitivity of any compromised data and follow the reporting and escalation procedures set forth in the incident response plan.
−Removed: Events that could have a high impact or that require additional judgment are escalated to the Information Security Council (“ISC”).
+Added: Events that could have a high impact or that require additional judgment are escalated to the ISC.
The ISC designates an incident response team to continue investigation of the incident to determine the extent of exposure and damage, and works to contain the damage and isolate the affected system, apply security measures and ultimately recover systems.
Should a cybersecurity incident be escalated to the ISC, the ISC notifies the Chief Legal Counsel in his capacity as chair of the ERC.
−Removed: In the event of a material cybersecurity incident, the Chief Legal Counsel, as chair of the ERC, would inform the Board of Directors or the executive committee thereof.
+Added: In the event of a cybersecurity incident that meets certain characteristics as defined in the incident response plan, the Chief Legal Counsel, as chair of the ERC, would inform the Board of Directors or the executive committee thereof.
Cybersecurity Risks
As of December 28, 2024, we have not had any material incidences involving cybersecurity attacks.
−Removed: However, we face risks associated with cybersecurity threats.
+Added: However, we previously have faced, and anticipate we will continue to face risks associated with cybersecurity threats.
Although we make efforts to maintain the security and integrity of our networks and systems, and the proprietary, confidential and personal information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a cybersecurity incident or disruption as described above, there can be no assurance that our security efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging.
−Removed: See “Risk Factors–Risks Related to Our Client
−Removed: Relationships–Information, technology systems or service failures, or a cybersecurity attack or other compromise of our or our client's confidential or proprietary information, could have a material adverse effect on our reputation, business and results of operations.”
+Added: See “Risk Factors–Risks Related to Our Client Relationships–Information, technology systems or service failures, or a cybersecurity incident or other compromise of our or our client's confidential or proprietary information, as well as any violation of data protection laws, could have a material adverse effect on our reputation, business and results of operations.”
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.