3 unchanged sentences
The Board, Audit Committee and senior management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.
−Removed: Our cybersecurity risk management program is incorporated into our enterprise risk management program and leverages industry standards and best practices, such as the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories:
−Removed: identify, protect, detect, respond and recover.
+Added: Our cybersecurity risk management program is incorporated into our enterprise risk management program and leverages industry standards and best practices, such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0), which organizes cybersecurity into six functions:
+Added: govern, identify, protect, detect, respond and recover.
We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation.
2 unchanged sentences
The Company’s Chief Information Security Officer (CISO) is responsible for developing and implementing and managing our cybersecurity security program and reporting on cybersecurity matters to the Audit Committee and the Board.
−Removed: Our CISO has over fifteen years of IT and cybersecurity leadership experience and has various industry related degrees and certifications, including a master’s in information technology and the Certified Information Systems Security Professional (CISSP) and Certified in Risk and Information Systems Control (CRISC) certifications.
+Added: Our CISO has over twenty-five years of IT and cybersecurity experience, has served over fifteen years in various cybersecurity management roles, and has various industry related degrees and certifications, including a master’s in information technology and the Certified Information Systems Security Professional (CISSP) and Certified in Risk and Information Systems Control (CRISC) certifications.
+Added: Our CISO is a part of, and is supported by, our IT security team, which includes other security leaders, security engineers, and security analysts.
The Board has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program.
3 unchanged sentences
Cybersecurity reviews by the Audit Committee or the Board occur quarterly, or more frequently as determined to be necessary or advisable.
−Removed: We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at technical and executive levels and incorporate external resources and advisors, as needed.
+Added: We view cybersecurity as a shared responsibility.
In an effort to detect and defend against cyber threats, the Company provides its employee-partners with various cybersecurity and data protection training programs and requires annual security awareness training participation.
6 unchanged sentences
Further, we conduct periodic external penetration tests and response testing to assess our processes and procedures against the evolving threat landscape.
−Removed: These tests and assessments are useful tools for maintaining a robust cybersecurity program that is designed to protect our investors, customers, employees, vendors and intellectual property.
+Added: These tests and assessments are useful tools for maintaining a cybersecurity program that is designed to protect our investors, customers, employees, vendors and intellectual property.
In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers.
7 unchanged sentences
We maintain an Incident Response Plan that includes processes and procedures for reviewing and responding to cybersecurity incidents.
−Removed: We periodically test our readiness to respond to a cybersecurity incident through various scenario-based drills.
−Removed: The Incident Response Plan includes processes for escalation to the CISO, the Executive Leadership Team, including the CEO and General Counsel, Audit Committee and the Board.
+Added: We periodically test our readiness to respond to a cybersecurity incident through various scenario-based drills at technical and executive levels and incorporate external resources and advisors, as needed.
+Added: The Incident Response Plan includes processes for escalation to the CISO, the Executive Leadership Team, including the CEO and General Counsel, the Audit Committee and the Board.
Our Incident Disclosure Committee has defined processes to determine whether a cybersecurity incident is material and may require disclosure in SEC filings.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.