6 unchanged sentences
Equifax has invested significantly to develop and maintain an information security program with processes, technology and controls to protect the information, systems and resources of the Company.
−Removed: We have a Security team operating under the leadership of our Chief Information Security Officer (“CISO”), including approximately 400 cybersecurity professionals.
+Added: We have a global Security team that operates under the leadership of our Chief Information Security Officer (“CISO”), including approximately 450 cybersecurity professionals.
The key elements of our information security program, including our cybersecurity risk management strategy, are described below.
Security Controls Framework
−Removed: Equifax has implemented a unified security and privacy controls framework as our primary mechanism to establish strategic priorities related to cybersecurity, assess cybersecurity risk across the enterprise, comply with regulatory requirements and enhance security program maturity.
+Added: Equifax has implemented a unified security and privacy controls framework as our primary mechanism to establish strategic priorities related to cybersecurity, assess cybersecurity risk across the enterprise, comply with regulatory requirements and
+Added: enhance security program maturity.
Our unified security and privacy controls framework is based upon the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) and Privacy Framework (NIST PF).
10 unchanged sentences
As part of our incident detection and response process, we have established internal teams to investigate and escalate notification of cybersecurity incidents.
−Removed: Pursuant to this process, cybersecurity incidents are reported to appropriate personnel within Equifax (including the CISO and the CEO) and to the Board of Directors based on incident severity.
+Added: Pursuant to this process, cybersecurity incidents are reported to appropriate personnel within Equifax (including our CISO and CEO) and to the Board of Directors based on incident severity.
We track incidents through resolution, conduct post-incident analysis and update our processes and procedures if areas for improvement are identified.
−Removed: On a monthly basis, a summary of prior period cybersecurity investigation escalations is reviewed by management, including our head of Internal Audit, our CISO, our Chief Financial Officer and our Chief Legal Officer.
+Added: On a monthly basis, a summary of prior period cybersecurity investigation escalations is reviewed by management, including our head of Internal Audit, Corporate Controller, CISO, Chief Technology Officer (“CTO”), Chief Financial Officer and Chief Legal Officer.
To inform our incident detection and response process, our cyber intelligence operations team regularly performs exercises to simulate real threat scenarios that would be carried out by a perpetrator by utilizing the actual tools and methodologies that would be deployed in such an attack (so called “red team” activities).
1 unchanged sentence
• Cybersecurity Incorporated into Enterprise Risk Management Program.
−Removed: We have implemented an enterprise risk management (“ERM”) program that operates under the leadership of our Chief Privacy and Compliance Officer.
+Added: We have implemented an enterprise risk management (“ERM”) program that operates under the leadership of our Chief Risk, Privacy and Compliance Officer.
Each business unit and corporate support unit has primary responsibility for assessing and mitigating risks within its respective areas of responsibility, and the ERM team is responsible for oversight and reporting to management and the Board.
21 unchanged sentences
Our Security team has implemented a due diligence and integration process for entities we acquire through mergers and acquisitions (“M&A”).
−Removed: This process is designed to protect our information systems, align acquired entities with our security controls, and comply with applicable legal and regulatory requirements, without interrupting critical business processes.
+Added: This process is designed to protect our information systems, align acquired entities with our security controls, and comply with applicable legal and
+Added: regulatory requirements, without interrupting critical business processes.
Our M&A security integration status is reported regularly to management and the Technology Committee and annually to the Board of Directors.
11 unchanged sentences
Equifax has a formal process in place to annually assess our security program maturity, which is a measure of our ability to adapt to cyber threats and manage risk over time.
−Removed: Under the oversight of the Technology Committee of the Board of Directors, Equifax engages a third party research and advisory firm to conduct an annual analysis of the maturity of our security program and identify potential
−Removed: initiatives to enhance maturity.
+Added: Under the oversight of the Technology Committee of the Board of Directors, Equifax engages a third party research and advisory firm to conduct an annual analysis of the maturity of our security program and identify potential initiatives to enhance maturity.
On an annual basis, the Technology Committee reviews the results of this analysis with management, including a review of Company performance against relevant benchmarks.
19 unchanged sentences
of this annual report on Form 10-K.
−Removed: Board Oversight of Cybersecurity
+Added: Board Oversight of Cybersecurity Risk
The Equifax Board of Directors monitors our “tone at the top” and risk culture and oversees principal risks facing the Company.
4 unchanged sentences
• Regular reports from the internal audit department regarding the security and technology portions of the internal audit plan
−Removed: • Regular reports from our CISO and Chief Technology Officer regarding the cybersecurity control environment, including remediation updates, control posture analyses and other recurring items
−Removed: • Regular reports from our Chief Privacy and Compliance Officer regarding our global privacy, risk management and compliance programs, including matters related to cybersecurity
+Added: • Regular reports from our CISO and CTO regarding the cybersecurity control environment, including remediation updates, control posture analyses and other recurring items
The Technology Committee of the Board oversees our information security program, including:
4 unchanged sentences
• Reviewing the results of our annual security program risk assessment prepared by management
+Added: The Audit Committee of the Board discusses with management our risk management policies and procedures, including:
+Added: • Receiving regular quarterly reports from our Chief Risk, Privacy and Compliance Officer regarding our global privacy, risk management and compliance programs, which includes the results of second line testing of our security controls
Management Oversight of Cybersecurity Risk
1 unchanged sentence
• Senior Leadership Team.
−Removed: The Equifax senior leadership team, consisting of our CEO and his direct reports (“SLT”), sets the tone for strategic growth, effective operations and risk mitigation at the management level.
+Added: The Equifax senior leadership team (“SLT”), sets the tone for strategic growth, effective operations and risk mitigation at the management level.
The SLT supports the management of the information security program through proper resource allocation and decision-making involving high risk issues.
1 unchanged sentence
• Chief Information Security Officer .
−Removed: Equifax has a CISO who is a member of the SLT and reports directly to our CEO.
−Removed: Our CISO has more than two decades of experience in cybersecurity-related roles, including serving as CISO at other large, multinational companies.
−Removed: Our CISO is responsible for the assessment and management of material risks from cybersecurity threats, including oversight of the global Security team and the implementation and execution of the information security program.
−Removed: Our CISO helps ensure that the program is strategically aligned to Equifax’s business strategy and is responsible for reporting on the effectiveness of the program to the SLT and the Board of Directors .
+Added: Equifax has a CISO who oversees our information security program, with responsibility for (i) oversight of the global Security team, (ii) the design, implementation and execution of the program, (iii) the assessment and management of material risks from cybersecurity threats, (iv) ensuring that the program is strategically aligned to our business strategy and (v) reporting on the effectiveness of the program to the SLT and the Board of Directors .
+Added: Prior to joining Equifax, our CISO served in a management role at a leading global cybersecurity firm, where he led hundreds of cyber engagements for Fortune 100 and 500 companies with a focus on mitigating emerging threats, scaling security operations through automation and AI and enhancing cyber resilience.
• Global Security Team.
1 unchanged sentence
The Security team is directly responsible for the day to day program activities such as planning, implementation, monitoring and reporting on operational capabilities.
+Added: • Chief Technology Officer.
+Added: Our CTO partners with our CISO to help ensure the effective execution of our information security program.
+Added: Our CTO served in the role of CISO from 2018 until his appointment as CTO in 2025.
+Added: He has more than two decades of experience in cybersecurity-related roles, including serving as CISO at other large, multinational companies.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.