4 unchanged sentences
Such controls, practices, and safeguards include, but are not limited to, published security policies, firewalls, intrusion prevention solutions, anti-malware solutions, data encryption, data loss prevention, security logging and monitoring, security configuration hardening, security patch/update management, remote access security, security risk management, vulnerability and threat management, security training and awareness, security controls testing, identity and access management, secure solutions development, and a comprehensive security incident response plan.
−Removed: Our Vice President and Chief Information Security Officer
−Removed: (“CISO”), who has approximately 30 years of experience in the information technology field with approximately 25 years of full cybersecurity focus and approximately 20 years as a Certified Information Systems Security Professional (CISSP), has responsibility for assessing and managing our information security program and related risks, which includes information security incident prevention, detection, mitigation and remediation, and leading a department of information security professionals with relevant industry and professional experience.
−Removed: Our CISO reports directly to our Executive Vice President and Chief Information Officer (“CIO”), who has approximately 25 years of experience in the information technology field that includes direct interaction with or supervision of cybersecurity functions.
+Added: Our Vice President and Chief Information Security Officer (“CISO”), who has approximately 30 years of experience in the information technology field with approximately 25 years of full cybersecurity focus and approximately 20 years as a Certified Information Systems Security Professional, has responsibility for assessing and managing our information security program and related risks, which includes information security incident prevention, detection, mitigation and remediation, and leading a department of information security professionals with relevant industry and professional experience.
+Added: Our CISO reports directly to our Executive Vice President and Chief Information Officer (“CIO”) , who has approximately 25
+Added: years of experience in the information technology field that includes direct interaction with or supervision of cybersecurity functions.
We also maintain a third-party security risk management program to identify, oversee, prioritize, assess, and mitigate third party risks ;
6 unchanged sentences
The Audit Committee of our Board of Directors oversees our cybersecurity risks through various means, including but not limited to its oversight of our enterprise risk management program.
−Removed: In connection with its oversight of this program, our Audit Committee discusses with management the process by which risk assessment and risk management is undertaken and our major financial and other risk exposures, including without limitation those relating to our information systems, information security, data privacy, business continuity, and third-party information security, and the steps management has taken to monitor and control such exposures.
+Added: In connection with its oversight of this program, our Audit Committee discusses with management the process by which risk assessment and risk management is undertaken and our major financial and other risk exposures, including without limitation those relating to information systems, information security, data privacy, business continuity, artificial intelligence, and third-party information security, and the steps management has taken to monitor and control such exposures.
Our Audit Committee reviews enterprise risk evaluation results at least annually and high residual risk categories, along with their mitigation strategies, quarterly.
−Removed: In addition to consideration as part of the enterprise risk management program, cybersecurity risk is further evaluated through various internal and external audits and assessments designed to validate the effectiveness of our controls for managing the security of our information assets, and management develops action plans to address select identified opportunities for improvement.
+Added: In addition to consideration as part of the enterprise risk management program, cybersecurity risk is further evaluated through various internal and external audits and assessments designed to validate the effectiveness of our controls for managing the security of our information assets.
+Added: Management develops action plans to address select identified opportunities for improvement identified through these assessments.
Additionally, our Audit Committee quarterly reviews reports and metrics, including a dashboard, pertaining to cybersecurity risks and prevention, detection, mitigation and remediation efforts with our CIO and CISO to help our Audit Committee understand and evaluate current risks, monitor trends, and track our progress against specific metrics.
1 unchanged sentence
Further, our Audit Committee receives quarterly updates regarding our business continuity and IT disaster recovery plan, as well as cybersecurity incidents which occurred during the prior quarter.
−Removed: Our Audit Committee also has undertaken cybersecurity education in recent years to assist members in overseeing related risks.
−Removed: Such activities included a cyber threat intelligence update focusing on the global impact of ransomware on the retail sector and trends in retail sector compromises;
−Removed: the state of cybersecurity regulation;
−Removed: an overview of methods to perform cyber risk quantification;
−Removed: an update on the evolving retail landscape’s impact on cyber risk to retail organizations;
−Removed: and an overview of Company-specific cyber-related risks considerations.
+Added: The Audit Committee receives cybersecurity education to assist members in overseeing related risks.
+Added: This education includes or has included in recent years:
+Added: an overview of Company-specific cyber-related risks considerations;
+Added: an overview of various artificial intelligence considerations, including those related to risk management, governance and ethics, and workforce and culture;
+Added: updates on the state of cybersecurity regulation;
+Added: updates on the evolving retail landscape’s impact on cyber risk to retail organizations;
+Added: a cyber threat intelligence update focusing on the global impact of ransomware on the retail sector and trends in retail sector compromises;
+Added: and an overview of methods to perform cyber risk quantification.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.