21 unchanged sentences
However, the sophistication of and risks from cybersecurity threats and incidents continues to increase, and the preventative actions the Company has taken and continues to take to reduce the risk of cybersecurity threats and incidents and protect its systems and information may not successfully protect against all cybersecurity threats and incidents.
−Removed: For more information on how cybersecurity risk could materially affect the Company’s business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.
+Added: For more information on how cybersecurity risk could materially affect the Company’s business strategy, results of operations, or financial condition, please refer to “Item 1A.
+Added: Risk Factors.”
Given the Company’s status as a pawn store operator and payment solutions company entrusted with the safeguarding of sensitive customer information, the Board believes that a strong enterprise cybersecurity program is vital to the Company’s overall enterprise risk management.
1 unchanged sentence
The Board has tasked the Audit Committee of the Board with leading the Company’s cyber and technology risk mitigation efforts.
−Removed: As part of its oversight responsibilities, the Audit Committee is responsible for discussing with management the Company’s major risk exposures, such as cybersecurity, and the steps management has taken to monitor and control those exposures, including the Company’s risk assessment and risk management policies.
+Added: As part of its oversight responsibilities, the Audit Committee is responsible for discussing with management the Company’s major risk exposures, related to cybersecurity and technology, and the steps management has taken to monitor and control those exposures, including the Company’s risk assessment and risk management policies.
The Audit Committee also monitors the Company’s compliance with legal and regulatory requirements and the risks associated therewith.
4 unchanged sentences
security standards such as NIST, ISO, COBIT and ITIL;
−Removed: risk management and incident response.
+Added: and risk management and incident response.
The CIO prepares reports on IT general controls and cybersecurity metrics for the Audit Committee on a regular basis, and the CIO presents those reports to the Audit Committee and addresses any questions and concerns raised by the Audit Committee.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.