2 unchanged sentences
We maintain a comprehensive cybersecurity and data privacy program to safeguard the security, confidentiality, integrity, availability and protection of the Company’s and our clients’ information.
−Removed: Cyber security is also an inherent consideration for our data and AI-led solutions.
−Removed: Specifically, there is a heightened focus on institutionalizing a Responsible AI framework to proactively identify and mitigate data protection and privacy risks.
−Removed: We aim to continually strengthen our cybersecurity posture and protocols by investing in people, processes and technology intended to protect information throughout the business life cycle and to manage cybersecurity risk, and we intend to continue to do so as cybersecurity risks and methods for preventing against them evolve.
−Removed: No assurance can be given that the policies and procedures outlined below will be properly followed in every instance or that they will be effective in safeguarding against every possible cybersecurity threat.
+Added: Cybersecurity is also an inherent consideration for our data and AI-led solutions.
+Added: Specifically, we aim to proactively identify and mitigate data protection and privacy risks through responsible AI practices.
+Added: We work to continually strengthen our cybersecurity posture and protocols by investing in people, processes and technology intended to protect information throughout the business life cycle and to manage evolving cybersecurity risk.
+Added: There can be no assurance that these policies and procedures will be effective in safeguarding against every possible cybersecurity or AI threat or that there will be no material incidents in the future.
We describe how cybersecurity threats are likely to materially affect our business, results of operations, and financial conditions in Part I, Item 1A, “Risk Factors” under “Risks Related to Our Business–– Unauthorized disclosure of sensitive or confidential client and employee data, whether through breach of our computer systems or otherwise, could cause us significant reputational damage, expose us to protracted and costly litigation, and cause us to lose clients.” We believe that these risks have not materially affected our business to date, but we can provide no assurance that they will not affect us in the future.
2 unchanged sentences
Our cybersecurity strategy is founded on policies, processes and practices that are integrated into our overall risk management system.
−Removed: These policies, processes and practices are aimed at building a cyber-resilient organization by implementing and operationalizing cybersecurity capabilities to identify, protect, detect, respond and recover from cybersecurity threats and incidents and are guided by relevant regulatory and governance bodies, including but not limited to the Cyber Security Framework of the National Institute of Standards and Technology.
+Added: These policies, processes and practices are aimed at building a cyber-resilient organization by implementing and operationalizing cybersecurity capabilities to identify, protect, detect, respond and recover from cybersecurity threats and incidents and are guided by relevant regulatory and governance bodies, including but not limited to the Cyber Security Framework of the National Institute of Standards and Technology (NIST).
We have undertaken measures designed to comply with applicable privacy laws and regulations that are applicable to our services.
These security capabilities are designed to mitigate vulnerabilities and the impact of cyber incidents.
−Removed: Cyber security is an inherent consideration for our data and AI-led digital solutions.
−Removed: There is heightened focus on institutionalizing a Responsible AI framework that includes periodic Secure AI assessments to proactively identify and mitigate data protection and privacy risks.
+Added: Cybersecurity is an inherent consideration for our data and AI-led solutions.
+Added: We aim to conduct periodic assessments to proactively identify and mitigate data protection and privacy risks in AI and manage risks through a layered approach that combines human oversight, technology and security controls.
We regularly conduct cybersecurity and other risk assessments and compliance audits both internally and through third party auditors that we independently engage or that we engage in connection with our certification to certain international standards, such as the ISO 27001:2013 standard for information security management systems, PCI DSS for handling financial data, the ISO 22301:2012 for business continuity management systems, the ISO 9001:2008 standard for quality management systems, SOC 1 TYPE II and SOC 2 TYPE II, among others.
6 unchanged sentences
While processes are in place to minimize the occurrence of a successful cyberattack, we have institutionalized detailed incident response procedures to address a cyber threat that may occur despite these safeguards.
−Removed: The response procedures are designed to identify, analyze, isolate and contain, remediate, and, if applicable, report any such material cyber incidents that occur.
+Added: The response procedures are
+Added: Ta ble of Contents
+Added: designed to identify, analyze, isolate and contain, remediate, and, if applicable, report any such material cyber incidents that occur.
We have developed a materiality assessment approach for cyber and a cyber crisis communication methodology for structured and timely notification to internal and external stakeholders.
3 unchanged sentences
We maintain a comprehensive information and cybersecurity awareness and training program for all employees and contracted resources.
−Removed: This includes a mandatory annual information security training, periodic simulations such as red teaming and tabletops, regular communications on relevant topics and policies related to data privacy, phishing, email security best practices, among others.
+Added: This includes a mandatory annual information security training, cyber awareness month, periodic simulations such as red teaming and tabletops, regular communications on relevant topics and policies related to data privacy, phishing, email security best practices, among others.
We provide specialized security training for certain roles with access to sensitive data, including human resources or employees who regularly handle personal or sensitive information.
6 unchanged sentences
Our senior management and board of directors participate in periodic cyber tabletop exercises to further enhance our preparedness in the event of an actual incident.
−Removed: The Cyber Security program including security operations, governance, risk and compliance, data privacy, and business continuity is led by our Chief Information Security Officer (“CISO”) who has over 25 years of extensive experience in technology and data center architecture, client solutioning, complex program management and nearly a decade in cyber risk management, governance and incident handling.
+Added: The Cybersecurity program including security operations, governance, risk and compliance, data privacy, and business continuity is led by our Chief Information Security Officer (“CISO”) who has over 25 years of extensive experience in technology and data center architecture, client solutioning, complex program management and a decade in cyber risk management, governance and incident handling.
Our CISO is supported by a team of cyber experts, many of whom are certified professionals in areas of security architecture, threat hunting, incident response, application security, business resiliency and data privacy among others.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.