34 unchanged sentences
Our cybersecurity incident management plan comprises the following six-step process:
−Removed: • The Service Center's Chief Information Officer and Director of Information Security lead its ISO team in the development, documentation, review and testing of security procedures and incident management procedures.
+Added: • The Service Center's Chief Information Officer and Chief Information Security Officer oversee its ISO team in the development, documentation, review and testing of security procedures and incident management procedures.
Beyond initial creation, procedures are continually re-assessed, updated and tested on an ongoing basis.
• The ISO team works with the Executive Team on the identification, assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact.
−Removed: • The Service Center's Chief Information Officer and Director of Information Security are responsible for launching the Incident Response Team (IRT) if necessary and for notification to the Executive Team, who in turn will contact the Board of Directors and the Audit Committee to validate that the response is being addressed appropriately.
+Added: • The Service Center's Chief Information Officer and Chief Information Security Officer are responsible for launching the Incident Response Team (IRT) if necessary and for notification to the Executive Team, who in turn will contact the Board of Directors and the Audit Committee to validate that the response is being addressed appropriately.
• The IRT, in consultation with outside experts if needed, is responsible for the following:
8 unchanged sentences
A final incident report will then be provided to key stakeholders and IRT members, which includes, but is not limited to the summary of the incident and its impact, a timeline of events, a detailed description of the incident, an evaluation of the organizational response and an assessment of the damages.
−Removed: We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years.
−Removed: Moreover, risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition.
+Added: We have not experienced a material cybersecurity breach.
While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that our company faces, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A.
Risk Factors .
−Removed: Our Audit Committee receives quarterly reports on our information security and cyber fraud prevention programs from the Service Center's Chief Information Officer and Director of Information Security , who each have over 24 years of experience in IT, including various leadership roles at other large corporations.
+Added: Our Audit Committee receives quarterly reports on our information security and cyber fraud prevention programs from the Service Center's Chief Information Officer and Chief Information Security Officer , who each have over 24 years of experience in IT, including various leadership roles at other large corporations.
One of the three members of our Audit Committee is a cybersecurity expert.
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.