1 unchanged sentence
Cybersecurity
−Removed: Cybersecurity Oversight
−Removed: Our Board of Directors is responsible for ensuring that the Company has effective procedures for assessing and managing risks to the Company’s operations, financial position, and reputation.
−Removed: The Board has charged the Audit Committee with responsibility for monitoring the Company’s processes and procedures for risk assessment and risk management.
−Removed: Cybersecurity represents an important component of our overall approach to enterprise risk management.
−Removed: The Audit Committee receives regular reports, including twice annually from our Chief Information Security Officer (“CISO”), on a wide range of cybersecurity topics, including our cybersecurity program’s performance, emerging threats, capability enhancements, recent developments, evolving standards, technological trends and other relevant topics.
−Removed: The Audit Committee also receives an update at least quarterly on the Company’s cybersecurity metrics and key performance indicators.
−Removed: Executive leadership is continually apprised of developments pertaining to our cybersecurity program through electronic communications and senior leadership meetings.
−Removed: Cybersecurity Roles and Capabilities
−Removed: Our CISO, in coordination with members of our senior leadership team such as our Chief Executive Officer (“CEO”), Chief Financial Officer (“CFO”) and General Counsel (“GC”), works collaboratively across the Company to operate a program designed to protect our business from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans.
−Removed: To facilitate the success of our cybersecurity risk management program, multidisciplinary teams are deployed to address cybersecurity threats.
−Removed: Through ongoing communications with these teams, our CISO and senior leadership team monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time.
−Removed: Our CISO is responsible to communicate potential and actual cybersecurity incidents to our senior leadership team in a prompt manner.
−Removed: We have established internal reporting processes so that the Board of Directors and the Audit Committee promptly will receive information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.
−Removed: Such processes are evaluated on a regular basis.
−Removed: In the event of a cybersecurity incident, the materiality of the incident will be evaluated and determined with appropriate input from the CEO, CFO, GC, CISO and other key participants in our cybersecurity program, including outside advisors to the extent appropriate.
−Removed: Our CISO, reporting to our CFO, leads our cybersecurity program.
−Removed: Our CISO has more than 20 years of cybersecurity experience and holds CISSP (2002) and CISM (2009) certifications.
−Removed: The cybersecurity team reporting to our CISO is staffed by highly skilled cybersecurity professionals, including both internal staff and external partners.
−Removed: Many team members have one or more industry recognized cybersecurity certifications such as Certified Information Systems Security Professional (CISSP), Global Information Assurance Certification (GIAC), Certified Information Security Manager/Auditor (CISM/CISA).
−Removed: In addition, our CEO, CFO and GC each hold undergraduate and graduate degrees in their respective fields, and each have extensive experience managing risks at Crane NXT and at similar companies.
−Removed: Our security operations team is responsible for detecting, mitigating, and responding to cybersecurity threats through a network of technologies, capabilities, and best practices on a 24/7 basis.
−Removed: This team consists of both internal employees located in several countries as well as a partner organization who supports our security operations team 24/7.
−Removed: Cybersecurity Risk Management and Strategy
−Removed: Our cybersecurity policies, standards, processes and practices are fully integrated into our enterprise risk management programs and are based on recognized frameworks and other applicable standards.
−Removed: Our cybersecurity program has comprehensive processes for assessing, identifying, and managing material risks from cybersecurity threats.
−Removed: Our cybersecurity program utilizes a risk-based, multi-layered information security approach following the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls.
−Removed: program has adopted and implemented an approach to identify and mitigate cybersecurity risks that include commercially reasonable technologies for companies with similar risk profiles.
−Removed: Our cybersecurity program is regularly assessed through activities such as penetration tests, internal audit assessments, an annual external PCI compliance audit in the CPI business, and ISO 27001 re-certification in the Currency business.
−Removed: The results of these assessments are reported to our Audit Committee, and we adjust our cybersecurity policies, standards, processes and practices to reduce cybersecurity risk based on the information provided by these exercises and assessments.
−Removed: Our cybersecurity team also conducts an annual incident response exercise that includes executive leaders to ensure alignment should we experience a cybersecurity incident.
−Removed: We provide regular training and awareness for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.
−Removed: Cybersecurity Identified Risks
−Removed: As of the date of the filing of this Current Report on Form 10-K, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, nor are they reasonably likely to affect, us, including our business strategy, results of operations, or financial conditions.
−Removed: We could be adversely affected in the future by any information system or technology network failure or breach in data security, including any such failure or breach involving personally identifiable or other confidential information, any non-compliance with our contractual or other legal obligations regarding such information, or any violation of our privacy and security policies with respect to such information.
−Removed: See also Item 1A, Risk Factors, “Information systems and technology networks failures and breaches in data security, personally identifiable and other information, non-compliance with our contractual or other legal obligations regarding such information, or a violation of our privacy and security policies with respect to such information, could adversely affect us.”
+Added: Risk Management and Strategy
+Added: Our enterprise risk management includes a comprehensive cybersecurity risk management program with policies, standards, processes and practices based on recognized industry standards and frameworks such as the National Institute of Standards and Technology (NIST), Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls.
+Added: Our cybersecurity program includes regular training for personnel, an incident response protocol tested at least annually as part of our enterprise-wide crisis response program, cybersecurity insurance, and regular assessments through activities such as penetration testing, and compliance audits performed on our information technology networks and systems by both our internal cybersecurity teams and external service providers .
+Added: Although we have continued to invest in our due diligence, onboarding, and monitoring capabilities over external partners with whom we do business, including our third-party vendors and service providers, our control over the security posture of, and ability to monitor the cybersecurity practices of, such external partners remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such external partners.
+Added: When we do become aware that an external partner has experienced such compromise or failure, we attempt to mitigate our risk, including by terminating such external partner’s connection to our information technology networks and systems where appropriate.
+Added: For more information on cybersecurity risks and how they affect our business, operating results and financial condition, refer to Item 1A, Risk Factors.
+Added: As of the date of the filing of this Current Report on Form 10-K, we have not identified any risks from a cybersecurity threat or incident that we believe has materially affected or is reasonably likely to materially affect the Company.
+Added: Governance, Oversight and Leadership
+Added: Our Board of Directors has charged the Audit Committee with responsibility for monitoring the Company’s processes and procedures for enterprise risk identification, assessment and management, and cybersecurity represents an important component of our overall approach to enterprise risk management.
+Added: The Audit Committee receives regular reports at least twice annually from our Chief Information Security Officers (“CISO”) on a wide range of cybersecurity topics, including our cybersecurity program’s performance, results of assessments, emerging threats, capability enhancements, and recent developments and trends.
+Added: Our CISO , who reports to our Chief Financial Officer (“CFO”), leads our cybersecurity program and has more than 20 years of cybersecurity experience.
+Added: The cybersecurity teams reporting to our CISO are staffed by highly skilled cybersecurity professionals, including both internal staff and external partners, with broad knowledge of cybersecurity issues from experience and through training and certifications.
+Added: Our cybersecurity teams are responsible for detecting, mitigating, and responding to cybersecurity threats through a network of technologies, capabilities, and best practices on a 24/7 basis.
+Added: Our CISO, in coordination with our cybersecurity teams, and members of our senior leadership team such as our Chief Executive Officer (“CEO”), CFO and General Counsel (“GC”), works collaboratively across the Company to operate a program designed to protect our business from cybersecurity threats and respond to any cybersecurity incidents in accordance with our incident response and recovery plans in real time.
+Added: We have established internal reporting processes designed to ensure that our Board of Directors and the Audit Committee receive information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.
+Added: In the event of a cybersecurity incident, the materiality of the incident will be evaluated and determined with appropriate input from the CEO, CFO, GC, CISO and other key participants in our cybersecurity program, including external advisors to the extent appropriate.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.