7 unchanged sentences
These controls include endpoint protection and response software (anti-virus), network intrusion detection devices, a vulnerability management program, IT and third-party risk management programs, and multifactor authentication.
−Removed: We provide annual security awareness training for corporate and store associates, and we administer periodic phishing testing and training to associates
−Removed: who have access to a company email address.
+Added: We provide annual security awareness
+Added: training for corporate and store associates, and we administer periodic phishing testing and training to associates who have access to a company email address.
The security of the National Vision network is monitored by a Security Operations Center (“SOC”), which works with our information security team with the aim of preventing realization of attacks by threat actors.
4 unchanged sentences
We also conduct third-party HIPAA risk assessments to identify and catalog potential risks to health data.
−Removed: As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
+Added: In the last three fiscal years, we have not experienced a material information security breach incident and the expenses we have incurred from information security breach incidents have been immaterial, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business, including our business strategy, results of operations, or financial condition.
However, as discussed under “Item 1A.
5 unchanged sentences
The Vice President of Information Technology Infrastructure collaborates with the CTO and a supporting team to maintain and update the Company’s technology infrastructure and corresponding safety measures.
−Removed: Our VP of Information Technology Infrastructure has served in this role at the Company for over six years, has over 25 years of experience in information technology systems and holds a bachelor of science degree in computer information systems.
+Added: Our VP of Information Technology Infrastructure has served in this role at the Company for over seven years, has over 25 years of experience in information technology systems and holds a bachelor of science degree in computer information systems.
Our CTO is informed about, and monitors the prevention, detection, mitigation and remediation of, cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.
When a cybersecurity incident occurs or we identify a vulnerability, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity, and external experts may also be engaged as appropriate.
−Removed: The audit committee of our Board oversees our enterprise risk management process, which includes risks from cybersecurity threats.
+Added: The audit committee of our Board, pursuant to its charter, oversees our enterprise risk management process, which includes risks from cybersecurity threats.
The audit committee regularly receives reports from management with respect to risks from cybersecurity threats and quarterly reviews cybersecurity and data security risks and mitigation strategies, along with program assessments, planned improvements and the status of information technology initiatives with the CTO.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.