4 unchanged sentences
As part of the Company’s cybersecurity program, Everest has established cross-functional teams with roles and responsibilities for cybersecurity incident response.
−Removed: The Company has a formal incident response escalation process, which involves a dedicated Security Operation Center (“SOC”) as well as a cybersecurity incident response team (“CSIRT”), to further escalate to senior management and the Board, as appropriate.
−Removed: While the actual methods of incident response employed may differ based on the type and nature of the incident, our approach uses a combination of internal teams, external advisors and vendors with specialized skills to support the response and recovery efforts, including a process for escalating issues as needed to senior management and providing timely notification of cybersecurity incidents to law enforcement and regulatory bodies, as appropriate.
+Added: The Company has a formal incident response escalation process, which involves a dedicated Security Operation Center (“SOC”) as well as a incident response team (“IRT”), to further escalate to senior management and the Board, as appropriate.
+Added: While the actual methods of incident response employed may differ based on the type and nature of the incident, our approach uses a combination of internal teams, external advisors and vendors with specialized skills to support the response and recovery efforts, including a process for escalating issues as needed to senior management and providing timely notification of incidents to law enforcement and regulatory bodies, as appropriate.
Everest uses a multi-layered process for assessing, identifying and managing material risks from cybersecurity threats and manages its systems and processes both internally and with the assistance of specialized third-party service providers.
−Removed: The Company obtains timely cyber-threat intelligence from various sources and maintains intrusion detection, network firewall protections, advanced threat protection, endpoint detection and response, email filtering, DDoS and other protections to secure the company’s critical infrastructure.
+Added: The Company obtains timely cyber-threat intelligence from various sources and maintains intrusion detection, network firewall protections, advanced threat protection, endpoint detection and response, email filtering, distributed denial-of-service and other protections to secure the company’s critical infrastructure.
The SOC provides enhanced early detection of threat intelligence services, actively manages security tools, and monitors and responds to security alerts.
−Removed: The SOC also initiates incident response protocols, including escalating threats as needed to the CSIRT, including the Chief Information Security Officer (“CISO“), who can further escalate to other members of senior management and the Board, as may be appropriate.
−Removed: Various processes, including compiling security metrics, vulnerability scans, regular patching of software and hardware vulnerabilities, external penetration testing, internal phishing tests, red team exercises, and cyber incident response exercises are used to test the effectiveness of the overall cybersecurity control environment.
+Added: The SOC also initiates incident response protocols, including escalating threats as needed to the IRT, including the Chief Information Security Officer (“CISO“), who can further escalate to other members of senior management and the Board, as may be appropriate.
+Added: Various processes, including compiling security metrics, vulnerability scans, regular patching of software and hardware vulnerabilities, external penetration testing, internal phishing tests, red team exercises and incident response exercises are used to test the effectiveness of the overall cybersecurity control environment.
In addition to periodic self-assessment of various cybersecurity controls, the Company conducts annual independent NIST assessments to review its cybersecurity posture and to identify opportunities to enhance its cybersecurity controls and mitigate cybersecurity risk.
9 unchanged sentences
The Company views cybersecurity risk as an enterprise-wide concern that involves people, processes and technology.
−Removed: Accordingly, the Company’s Board, through the RMC, referenced above in ITEM 1 “Business” - Enterprise Risk Management, has ultimate responsibility for risk oversight, as described more fully in our Proxy Statement, while management is tasked with the day-to-day management of the Company’s cybersecurity risks.
+Added: The Company’s Board, through its committees, referenced above in ITEM 1 “Business” - Enterprise Risk Management, has ultimate responsibility for risk oversight.
+Added: In 2024, a Technology and Cyber Board Committee was established to further assist the Company Board’s oversight responsibilities with respect to information technology governance, strategy, delivery and risk management, including cybersecurity and data privacy.
+Added: Management is tasked with the day-to-day management of the Company’s cybersecurity risks.
The Company’s Board has a practical understanding of information systems and technology use in our business operations and processes, as well as a recognition of the risk management aspects of cyber risks and cybersecurity.
−Removed: The RMC, which oversees controls for the Company's major risk exposures, has principal responsibility for oversight of cybersecurity risk.
−Removed: The Company also appointed a certified Chief Information Security Officer (“CISO”) with significant public and private cybersecurity experience.
−Removed: The CISO is dedicated to assessing the Company’s data security risk, monitoring cyber threat intelligence and taking the steps necessary to implement pertinent safeguards and protocols to manage the risk.
−Removed: In addition, the Executive Risk Committee or ERC, referenced above in ITEM 1 “Business” - Enterprise Risk Management, annually reviews the Company’s cyber exposure across all lines of business and security safeguards for privacy-protected data held by the Company.
−Removed: The ERC, through its sub-committees, including the Operational Risk Committee and the Global IT and Cyber Risk Management Committee, works in conjunction with the Company’s CISO to assess the Company’s vulnerabilities to cybersecurity threats, including the operational risk of such threats to our business, as continuous dialogue throughout the year is essential in assessing the operational risk to our business of cybersecurity threats.
−Removed: The Operational Risk Committee and the Global IT and Cyber Risk Management Committee sub-committees meet quarterly in advance of the quarterly ERC meetings to, among other things, report on material cybersecurity risks.
−Removed: From a governance perspective, in addition to the CISO, senior members of Information Technology provide briefs on cybersecurity matters, the overall cyber resiliency posture of the Company, and the effectiveness of the Company’s cybersecurity program to the RMC.
+Added: In addition, the Company’s subsidiary boards of directors may also provide additional oversight.
+Added: The Company also appointed a certified CISO who has significant public and private cybersecurity experience.
+Added: The CISO is dedicated to assessing the Company’s data security risk, monitoring cyber threat intelligence and taking the steps
+Added: necessary to implement pertinent safeguards and protocols to manage the risk.
+Added: In addition, the ERC, referenced above in ITEM 1 “Business” - Enterprise Risk Management, annually reviews the Company’s cyber exposure across all lines of business and security safeguards for privacy-protected data held by the Company.
+Added: The ERC, through its sub-committees, including the Operational Risk Committee and the Global IT and Cyber Risk Management Committee, works in conjunction with the Company’s CISO to assess the Company’s vulnerabilities to cybersecurity threats, including the operational risk of such threats to our business, as continuous dialogue throughout the year is essential in assessing the operational risk to our business.
+Added: The Operational Risk Committee and the Global IT and Cyber Risk Management Committee sub-committees meet quarterly in advance of the quarterly ERC meetings to, among other things, review overall cybersecurity strategies and policies and to report on material cybersecurity risks.
+Added: From a governance perspective, in addition to the CISO, senior members of Information Technology provide briefs on cybersecurity matters, the overall cyber resiliency posture of the Company and the effectiveness of the Company’s cybersecurity program to the Board’s Technology and Cyber Committee.
The topics covered by these updates include the Company's activities, policies and procedures to prevent, detect and respond to cybersecurity incidents, as well as lessons learned from cybersecurity incidents and internal and external testing of our cyber defenses.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.