6 unchanged sentences
The Audit Committee reviews the Company’s policies with respect to risk assessment and enterprise risk management, including with respect to cybersecurity risks.
−Removed: Certain members of our Audit Committee have experience with respect to cybersecurity risk management and have attended external trainings.
+Added: Certain members of our Audit Committee have experience with respect to cybersecurity risk management.
The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.
−Removed: As part of such reviews, the Audit Committee receives reports and presentations from members of the Company’s management team responsible for overseeing the Company’s cybersecurity risk program, including the head of our global cybersecurity team.
+Added: As part of such reviews, the Audit Committee receives reports and presentations from members of the Company’s management team responsible for overseeing the Company’s cybersecurity risk program, including our Chief Information Officer (“CIO”).
These reports and updates may address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company’s peers and third parties.
1 unchanged sentence
We also have protocols by which certain cybersecurity incidents are escalated within the Company and, in certain circumstances, reported to the Board and/or Audit Committee in a timely manner.
−Removed: At the management level, the head of the global cybersecurity team is responsible for overseeing and implementing a cybersecurity strategy aligned with the Company’s goals and needs.
−Removed: Our head of global cybersecurity has extensive experience with respect to cybersecurity matters as a result of over 10 years of relevant work experience and holds multiple industry certifications.
−Removed: Our cybersecurity function is supported by cybersecurity personnel with substantial industry experience as well as our network of regional IT leaders and our global IT infrastructure team.
−Removed: The head of the global cybersecurity receives ongoing updates from such individuals regarding the prevention, detection, mitigation and remediation of cybersecurity incidents.
−Removed: In conjunction with management, the head of global cybersecurity regularly reviews risk management measures to identify and mitigate data protection and cybersecurity risks.
+Added: At the management level, our CIO is responsible for overseeing and implementing a cybersecurity strategy aligned with the Company’s goals and needs.
+Added: Our CIO has extensive experience with respect to cybersecurity matters as a result of over 20 years of relevant work experience.
+Added: Our cybersecurity function is supported by highly trained cybersecurity personnel with substantial industry experience as well as our network of specialized consulting partners, regional IT leaders and our global IT infrastructure team.
+Added: Our CIO receives ongoing updates from such individuals regarding the prevention, detection, mitigation and remediation of cybersecurity incidents.
+Added: In conjunction with management, the CIO regularly reviews risk management measures to identify and mitigate data protection and cybersecurity risks.
Key performance indicators, emerging threats, current trends and notable detections are reported to members of the Company’s senior leadership team.
4 unchanged sentences
The results of this risk assessment, including cybersecurity, are presented to the Board of Directors annually .
−Removed: The cybersecurity team implements, monitors and maintains controls leveraging the National Institute of Standards and Technology (“NIST”) CyberSecurity Framework.
+Added: The cybersecurity team implements, monitors and maintains controls that are aligned with the guidance defined by the National Institute of Standards and Technology (“NIST”) CyberSecurity Framework.
These controls are designed to protect the confidentiality, availability and integrity of information systems.
4 unchanged sentences
We have adopted a Global Cybersecurity Incident Response Procedure that applies in the event of a cybersecurity threat or incident.
−Removed: These procedures include an incident response playbook which outlines the steps to be addressed in the event of a cybersecurity incident, from incident detection to mitigation, recovery and notification within the Company and to the Audit Committee and/or Board of Directors, as specified.
+Added: These procedures include an incident response playbook that outlines the steps to be addressed in the event of a
+Added: cybersecurity incident, from incident detection to mitigation, recovery and notification within the Company and to the Audit Committee and/or Board of Directors, as specified.
We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information.
We employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use .
−Removed: Despite ongoing efforts to continued improvement of our and our vendors’ ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, disruption of our business operations, revenue and client loss, legal actions, or statutory penalties, among other consequences.
+Added: Despite ongoing efforts to continuously improve our holistic ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, disruption of our business operations, revenue and client loss, legal actions, or statutory penalties, among other consequences.
Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate and remediate cybersecurity incidents.
−Removed: While we are not aware of any material cybersecurity threats or incidents that have had or are reasonably likely to materially affect us, including having a long-term impact on our business strategy, results of operations or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents.
−Removed: For additional information the cybersecurity risks faced by our Company, refer to Item 1A.
+Added: While we are not aware of any material cybersecurity threats or incidents that have had or are reasonably likely to materially affect us, including those having a long-term impact on our business strategy, results of operations or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents.
+Added: For additional information on the cybersecurity risks faced by our Company, refer to Item 1A.
“Risk Factors—Risks Related to Our Business— Our electronic information systems have been and could in the future be, subject to service interruptions, data corruption, cyber-based attacks and network security breaches.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.