2 unchanged sentences
We operate in a highly regulated industry.
−Removed: Federal, state and international laws and contractual commitments guide our collection, use and disclosure of confidential information such as protected health information, personal financial information and personally identifiable information.
−Removed: Our success depends on maintaining a high level of trust among our stakeholders, including our consumers, clients, business partners, providers, regulators and associates.
+Added: Federal, state and international laws and regulations and contractual commitments guide our collection, use and disclosure of confidential information such as protected health information, personal financial information and personally identifiable information.
+Added: Our success depends on maintaining a high level of trust among our stakeholders, including our customers, business partners, providers, regulators and associates.
Failure to effectively secure, maintain and upgrade our information systems, or the availability and integrity of our data, could adversely affect our business, including our business strategy, cash flows, financial condition and results of operations.
Cybersecurity Risk Assessment
−Removed: Our cybersecurity and risk management programs are part of our continuously evolving enterprise-wide risk management practices.
+Added: Our comprehensive cybersecurity and risk management programs are part of our continuously evolving enterprise-wide risk management practices.
Aligned and measured against the National Institute of Standards and Technology (NIST) Cybersecurity Framework, recognized best practices and standards for cybersecurity and information technology, industry and government standards and other guidelines, our cybersecurity and risk management programs utilize policies, processes, and technologies to identify, assess, manage and mitigate cybersecurity risks and threats we face.
1 unchanged sentence
Our management implements ongoing and annual risk assessment processes to identify and manage risks that could affect our ability to safeguard sensitive data or provide reliable transaction processing and to minimize financial risk exposure.
−Removed: These risks include, but are not limited to, regulatory compliance;
+Added: These risks include, but are not limited to, legal and regulatory compliance;
third-party management , including risks from business partners and software providers;
4 unchanged sentences
fraud and extortion;
−Removed: and reputation risk.
+Added: and reputational risk.
The steps we take to reduce vulnerability to cyber-attacks and to mitigate and remediate the impact of cybersecurity incidents in a timely and coordinated manner include, but are not limited to:
establishing information security policies and standards, implementing information protection processes, tools and technologies, monitoring information technology systems for cybersecurity threats, coordinating internal reporting, assessing cybersecurity risk profiles of key third-parties, implementing cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices.
−Removed: In addition to our internal Information Security teams, we also utilize trusted third-party auditors and recognized cybersecurity consultants and certified assessors, to assess cybersecurity risks, related controls, and alignment to relevant regulatory and legal requirements.
+Added: In addition to our internal Information Security teams, we utilize trusted third-party auditors and recognized cybersecurity consultants and certified assessors, to assess our cybersecurity risks, related controls, and alignment to relevant regulatory and legal requirements.
A third-party evaluates our information security policies, standards and control environment at least annually.
−Removed: Assessments and testing protocols are performed against industry best practices and widely recognized security frameworks.
+Added: Assessments and testing protocols are performed by third parties against industry best practices and widely recognized security frameworks.
We face many cybersecurity risks in connection with our business.
1 unchanged sentence
however, future cybersecurity incidents or threats may materially affect us, including by affecting our business strategy, results of operations or financial conditions.
−Removed: See Part I, Item 1A.
−Removed: “Risk Factors” for more information on the Company’s cybersecurity-related risks.
+Added: See Part I, Item 1A, “Risk Factors” for more information on our cybersecurity-related risks.
Management and Governance of Cybersecurity Risk
To manage our cybersecurity risk, we employ a cross-organizational steering committee, the Information Security Steering Committee (“ISSC”), that supports the direction and governance of our enterprise-wide Information Security Program.
−Removed: The ISSC is chaired by our Chief Information Security Officer (“CISO”) and is comprised of accountable senior business leaders including our Chief Compliance Officer (“CCO”), Chief Risk Officer (“CRO”), legal counsel, and human resources, procurement and business segment leaders.
+Added: The ISSC is chaired by our Chief Information Security Officer (“CISO”) and is comprised of senior business leaders including our Chief Compliance Officer (“CCO”), Chief Risk Officer (“CRO”), legal counsel, and human resources, procurement and business segment leaders.
In addition to the ISSC, we have defined risk functions to cover overall enterprise risks and information technology and cybersecurity risks within our enterprise risk management framework, including, but not limited to:
our IT Risk Management Program, led by our CISO;
−Removed: our Responsible Artificial Intelligence (“RAI”) Program, led by our Chief Digital Information Officer;
+Added: our Responsible Artificial Intelligence (“RAI”) Program, led by our Chief Digital and Information Officer;
Compliance, led by our CCO;
5 unchanged sentences
To evaluate cybersecurity and privacy incidents and enable us to comply with public disclosure requirements, we have a Privacy and Security Incident Response and Reporting Policy and Procedure (the “Policy”) with defined escalation criteria (the “Plan”) in support of our incident response processes.
−Removed: The Plan provides a framework to our Cyber Incident Response Taskforce, comprised of our Chief Privacy Officer (“CPO”), CISO and applicable legal counsel and business and corporate services leaders, for responding to cybersecurity incidents.
−Removed: The Policy, together with the Plan, identifies applicable requirements for incident disclosure and reporting and also provides protocols for incident evaluation based on facts and circumstances of each incident, including the use of third-party service providers and partners, processes for notification and internal escalation of information to our senior management, including to our chief legal officer and CEO, a subcommittee of our SEC disclosure committee, and ultimately, our Board of Directors and appropriate Board committees.
+Added: The Plan provides a framework to our Cyber Incident Response Taskforce, comprised of our Chief Privacy Officer (“CPO”), our CISO, legal counsel and business and corporate services leaders, for responding to cybersecurity incidents.
+Added: The Policy, together with the Plan, identifies applicable requirements for incident disclosure and reporting and also provides protocols for incident evaluation based on the facts and circumstances of each incident, including the use of third-party service providers and partners, processes for notification and internal escalation of information to our senior management, including to our chief legal officer and CEO, a subcommittee of our SEC disclosure committee, and, ultimately, our Board of Directors and appropriate Board committees.
The Policy also addresses requirements for our external reporting obligations.
7 unchanged sentences
Cybersecurity Expertise
−Removed: Our Information Security Program has been established with the mission of minimizing risk to our member, client and associate data and it is managed by our CISO.
−Removed: Our current CISO has over 30 years of experience in information security and technology and has held a wide variety of technical and strategic leadership positions.
−Removed: He holds advanced certifications including Certified Information Systems Security Professional and Certified Secure Software Lifecycle Professional.
+Added: Our Information Security Program is designed to minimize risk and safeguard the data of our members, customers, and associates.
+Added: The program is led by our Chief Digital and Information Officer and our CISO, both of whom have extensive backgrounds in information security and technology.
+Added: Our Chief Digital and Information Officer has more than 25 years of experience, including leading enterprise digital transformation initiatives at major corporations, while our CISO brings over 25 years of experience across technical, operational, and strategic security leadership roles in global organizations.
Our associates, including those responsible for cybersecurity, are evaluated for competence, including the knowledge and skills necessary to accomplish tasks that define associates’ roles and responsibilities, and undergo regular training regarding security-awareness, privacy, ethics and compliance.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.