2 unchanged sentences
Cyber Risk Management and Strategy
−Removed: EastGroup incorporates cybersecurity processes, which include periodic tests of its information security processes and systems by external firms, into the Company’s overall risk management program.
−Removed: EastGroup has processes and policies regarding incident response, identity and access management, employee training on cybersecurity matters, device management, and patch and vulnerability management, among others.
−Removed: We also maintain processes regarding third-party vendor risk management, including, as appropriate, conducting a review of security ratings of and System and Organization Controls (“SOC”) reports provided by potential vendors.
+Added: Cybersecurity risk management policies and processes are integrated into EastGroup’s enterprise risk management program.
+Added: These policies and processes include incident response, identity and access management, employee training on cybersecurity matters, device management, patch management and vulnerability assessment.
+Added: The Company also maintains processes regarding third-party vendor risk management, including, as appropriate, conducting a review of security ratings of and System and Organization Controls (“SOC”) reports provided by potential vendors.
Additionally, EastGroup works with cybersecurity consulting firms to help manage the Company’s cybersecurity risks.
−Removed: The cyber consulting firms currently conduct testing of EastGroup’s controls and environment, including penetration testing, to identify and remediate cybersecurity risks.
−Removed: They also currently provide EastGroup with advice on technology, infrastructure, management, and productivity in relation to its information technology capabilities, including conducting phishing exercises with the Company’s employees.
+Added: The cyber consulting firms currently conduct testing of EastGroup’s controls and environment, including network penetration testing, to identify and remediate cybersecurity risks.
+Added: They also currently provide EastGroup with advice on technology, infrastructure, management, and productivity in relation to its information technology capabilities, including training for all employees.
+Added: This training supports information security awareness and adherence to Company policies and guidance through regular, mandatory training and random simulated phishing tests.
Additionally, EastGroup has information technology general controls in place in support of internal control over financial reporting.
These controls are tested by the Company’s internal audit function and control deficiencies, if any, would be reported to senior management and the Audit Committee of the Board of Directors.
+Added: As of the date of this report, the Company has not identified breaches from any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to affect operations, business strategy or financial condition.
+Added: For additional information regarding our cybersecurity risks, see “Item 1A.
+Added: Risk Factors - We rely on information technology in our operations, and any material failure, inadequacy, interruption or cyber-attack of that technology could harm our business.”
Governance Related to Cybersecurity Risks
EastGroup’s cybersecurity risk management process is assessed and managed by a cyber risk committee (“Cyber Risk Committee”), which includes the Company’s Chief Financial Officer (“CFO”), Chief Information Officer (“CIO”) and members of management within the information technology, finance and accounting, legal and internal audit functions.
−Removed: The CIO is a Certified Public Accountant (“CPA”), a Certified Information Technology Professional with the American Institute of CPAs and has 20 years of experience in the areas of cybersecurity and information technology.
+Added: The CIO is a Certified Public Accountant (“CPA”), a Certified Information Technology Professional with the American Institute of CPAs and has over 20 years of experience in the areas of cybersecurity and information technology.
Collectively, other members of the Cyber Risk Committee have technical expertise and experience in accounting, financial reporting and auditing, and law and compliance.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.