5 unchanged sentences
Our Board of Trustees oversees management’s process for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives.
−Removed: Senior leadership, including our Senior Vice President of Information Technology (the “SVP of IT”), meets with the Board of Trustees at least annually to present and discuss strategies and cybersecurity initiatives.
+Added: Our Board of Trustees has also delegated authority to its Audit Committee to review our internal controls relating to information technology, data privacy, including data protection and cybersecurity, including network security and cloud security.
+Added: Senior leadership, including our Senior Vice President of Information Technology (the “SVP of IT”) , meets with the Board of Trustees at least annually to present and discuss strategies
+Added: and cybersecurity initiatives.
This meeting includes reporting of cybersecurity incidents at least annually or more often, if identified.
5 unchanged sentences
A combination of internal and external monitoring services help identify, manage, and assess how management responds within our enterprise risk management processes.
−Removed: Any known known cybersecurity incidents would be reported to our board, chief executive officer, and disclosure committee for evaluation.
+Added: Any known cybersecurity incidents would be reported to our board, chief executive officer, and disclosure committee for evaluation.
We engage third party experts to monitor for and identify cyber threats .
7 unchanged sentences
Depending on the nature of the services provided and the sensitivity of information processed, our vendor management process may include contractually imposed obligations on the provider and reviewing the cybersecurity practices of such provider.
−Removed: In 2021, we suffered a ransomware attack on our information technology systems.
−Removed: This incident did not have a material impact on our business, operations, or financial condition;
−Removed: however, as a result, we began work on certain information technology initiatives earlier than originally planned.
−Removed: A security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence.
+Added: We have not suffered any cyber incident that had a material impact on our business, operations, or financial condition.
+Added: However, a security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information, and reputational damage adversely affecting investor confidence.
Further, a penetration of our systems or a third-party’s systems or other misappropriation or misuse of personal information could subject us to business, regulatory, litigation and reputation risk, which could have a negative effect on our business, financial condition and results of operations.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.