5 unchanged sentences
We also have a management-level risk management council that supports our processes to assess and manage cybersecurity and other risks.
−Removed: Our information security team oversees and implements security controls designed to minimize the risk or impact of any breach or unauthorized disclosure of our confidential and sensitive data, including protected health and personal information.
+Added: Our information security team oversees and implements security controls designed to minimize the risk or impact of any compromise or unauthorized disclosure of our or our customers’ confidential and sensitive data, including protected health information and PII.
These controls include endpoint protection and response software (anti-virus), network intrusion detection devices, a vulnerability management program, IT and third-party risk management programs, and multifactor authentication.
−Removed: We provide annual security awareness
−Removed: training for corporate and store associates, and we administer periodic phishing testing and training to associates who have access to a company email address.
−Removed: The security of the National Vision network is monitored by a Security Operations Center (“SOC”), which works with our information security team with the aim of preventing realization of attacks by threat actors.
−Removed: We also maintain an incident response plan which, among other things, is designed to mitigate the impact of an incident, assist in restoring normal business operations, comply with applicable regulatory obligations arising from an incident and prevent similar future incidents.
−Removed: Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers.
−Removed: Our Chief Technology Officer (“CTO”) collaborates with our information security and legal teams to conduct periodic table-top exercises and testing of our data security and incident response procedures.
−Removed: Periodically, we engage specialized third parties to conduct exercises that stress test our data security systems and practice company-wide response tactics.
−Removed: We also conduct third-party HIPAA risk assessments to identify and catalog potential risks to health data.
−Removed: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business, including our business strategy, results of operations, or financial condition.
−Removed: However, as discussed under “Item 1A.
−Removed: Risk Factors – We rely heavily on our information technology systems, as well as those of our vendors, for our business to effectively operate and to safeguard confidential information;
−Removed: any significant failure, inadequacy, interruption or security breach could adversely affect our business, financial condition and operations,” the sophistication of cyber threats continues to increase, and the actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient.
−Removed: As such, no matter how well our controls are designed or implemented, we cannot assure that we will be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.
−Removed: Our CTO oversees our approach to cybersecurity and is responsible for assessing and managing our material risks from cybersecurity threats.
−Removed: Our CTO has served in this role at the Company since 2020, and has more than 25 years of experience in the aggregate in various senior roles involving managing global information technology and security teams spanning strategy, implementation, operations and compliance.
+Added: We provide annual security awareness training for corporate and
+Added: store associates, and we administer periodic phishing testing and training to associates who have access to a company email address.
+Added: The security of the National Vision network is monitored by a Security Operations Center (“SOC”), which works with our information security team with the aim of preventing, detecting, and responding to cybersecurity attacks.
+Added: We also maintain an incident response plan which, among other things, is designed to outline the response actions to an incident, mitigate the impact of an incident, assist in restoring normal business operations, and comply with applicable regulatory obligations arising from an incident.
+Added: Our risk management processes also address cybersecurity threat risks associated with our use of third-party vendors.
+Added: Our Chief Technology Officer (“CTO”) collaborates with our information security and legal teams to conduct periodic tabletop exercises to test our data security and incident response procedures.
+Added: Periodically, we engage specialized third parties to assist in conducting these exercises.
+Added: We also conduct third-party HIPAA security risk assessments to identify and catalog potential security risks to health data.
+Added: In the last three fiscal years, we have not experienced a material information security incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business, including our business strategy, results of operations, or financial condition.
+Added: Further discussion of the potential impacts on our business from cybersecurity incidents is provided in “Item 1A.
+Added: Risk Factors – We rely heavily on our information technology systems, as well as those of our vendors, for our business to effectively operate and to safeguard sensitive and confidential information;
+Added: any significant failure, inadequacy, interruption or security incident could adversely affect our business, financial condition and operations,” the sophistication of cyber threats continues to increase, and the actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient.
+Added: As such, no matter how well our controls are designed or implemented, we cannot assure that we will be able to anticipate all security incidents, and we may not be able to implement effective preventive measures against such security incidents in a timely manner.
+Added: Our CTO oversees our cybersecurity program and is responsible for assessing and managing our material risks from cybersecurity threats.
+Added: Our CTO has served in this role at the Company since September 2025 and brings more than 30 years of industry experience in various senior roles involving managing global information technology and providing technology services in the areas of application development, infrastructure, data, and technology strategy, and specializing in Agentic AI, cloud solutions, enterprise software, and technology strategy.
The Vice President of Information Technology Infrastructure collaborates with the CTO and a supporting team to maintain and update the Company’s technology infrastructure and corresponding safety measures.
−Removed: Our VP of Information Technology Infrastructure has served in this role at the Company for over seven years, has over 25 years of experience in information technology systems and holds a bachelor of science degree in computer information systems.
+Added: Our VP of Information Technology Infrastructure has served in this role at the Company for over eight years, has over 25 years of experience in information technology systems and holds a bachelor of science degree in computer information systems.
Our CTO is informed about, and monitors the prevention, detection, mitigation and remediation of, cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.