8 unchanged sentences
The Compliance and Risk Committee periodically reports to the Board .
−Removed: The Company maintains an operational Incident Response Plan (“IRP”) that defines how the Company handles cyber incidents, including escalation, reporting and remediation procedures.
+Added: The Company maintains an operational Incident Response Plan (“IRP”) that defines how the Company handles cybersecurity incidents, including escalation, reporting and remediation procedures.
The IRP is reviewed annually both internally and by third parties during regular audits.
−Removed: In addition, the Company retains a preferred partner with expertise in cyber risks and incidents to advise on cybersecurity related matters.
+Added: In addition, the Company retains a preferred partner with expertise in cybersecurity risks and incidents to advise on cybersecurity related matters.
The Company’s preferred partner is also part of the Company’s IRP procedures and provides independent analysis and advice during cybersecurity investigations.
9 unchanged sentences
The Company also engages third-party consultants for incident responses.
−Removed: These third-party consultants report directly to the Chief Information Security Officer and, depending on the nature of the incident, report directly to the Executive Security Steering Committee on various topics including, effects of the incident and recommendations on how to strengthen the Company’s cybersecurity capabilities and mitigate the risk of a breach or incident.
+Added: These third-party consultants report directly to the Chief Information Security Officer and, depending on the nature of the incident, report directly to the Executive Security Steering Committee on various topics including, effects of the incident and recommendations
+Added: on how to strengthen the Company’s cybersecurity capabilities and mitigate the risk of a breach or incident.
In addition to assessing the Company’s cybersecurity preparedness, the Company also considers and evaluates cybersecurity risks associated with its use of third-party service providers.
1 unchanged sentence
The Company’s assessment of risks associated with use of third-party providers is part of the Company’s overall cybersecurity risk management program .
−Removed: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we face unknown cybersecurity risks, threats and attacks.
+Added: Although we have designed our cybersecurity program and governance procedures above to mitigate cybersecurity risks, we have experienced, and we may in the future experience cybersecurity risks, threats and attacks.
To date, these risks, threats or attacks have not had a material impact on our operations, business strategy or financial results, but we cannot provide assurance that they will not have a material impact in the future.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.