6 unchanged sentences
We engage independent third-parties to conduct ethical hacks of key systems, aiding our understanding of control effectiveness and facilitating the implementation of more robust controls.
−Removed: We periodically engage with a third-party assessment firm to conduct reviews of our overall program and to examine our security controls to help us better align our cybersecurity
−Removed: program with industry standards.
−Removed: To monitor and decrease the risks from cybersecurity threats associated with our use of third-party service providers , potential new vendors with a greater degree of system or data access are subjected to a security vetting process prior to engagement.
+Added: We periodically engage with a third-party assessment firm to conduct reviews of our overall program and to examine our security controls to help us better align our cybersecurity program with industry standards.
+Added: To monitor and decrease the risks from cybersecurity threats associated with our use of third-party service providers , potential new vendors with a greater degree of system or data access are subjected to a security vetting
+Added: process prior to engagement.
Existing critical vendors that store or process company or client information are reviewed annually through commercially reasonable efforts such as questionnaires.
17 unchanged sentences
The ISC designates an incident response team to continue investigation of the incident to determine the extent of exposure and damage, and works to contain the damage and isolate the affected system, apply security measures and ultimately recover systems.
−Removed: Should a cybersecurity incident be escalated to the ISC, the ISC notifies the Chief Legal Counsel in his capacity as chair of the ERC.
+Added: Should a cybersecurity incident be escalated to the ISC, the ISC notifies the General Counsel in his capacity as chair of the ERC.
In the event of a cybersecurity incident that meets certain characteristics as defined in the incident response plan, the Chief Legal Counsel, as chair of the ERC, would inform the Board of Directors or the executive committee thereof.
Cybersecurity Risks
−Removed: As of December 28, 2024, we have not had any material incidences involving cybersecurity attacks.
+Added: As of January 3, 2026, during the past three years, we have not experienced any cybersecurity incidents that have resulted in material disruption to operations, loss of data, or financial impact.
However, we previously have faced, and anticipate we will continue to face risks associated with cybersecurity threats.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.