7 unchanged sentences
As part of such reviews, the Audit Committee receives reports and presentations from members of our team responsible for overseeing the Company’s cybersecurity risk management, including senior members of our IT, Finance and Accounting, and Legal teams.
−Removed: We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee.
+Added: We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee and/or Board.
The executive management team, including our Chief Executive Officer, Chief Financial Officer and General Counsel, receives periodic reports from the IT Director regarding cybersecurity objectives and risk management measures being implemented by the Company and discusses these updates to identify and mitigate data protection and cybersecurity risks.
3 unchanged sentences
The IT Director receives regular reports on cybersecurity threats from the internal cybersecurity team and reviews risk management measures designed and implemented by the Company to identify and mitigate data protection and cybersecurity threats.
−Removed: Our IT Director works with the General Counsel and other members of the Legal Department to oversee compliance with legal, regulatory and contractual security requirements.
+Added: Our IT Director works with the General Counsel and other members of the Legal Department to ensure compliance with legal, regulatory and contractual security requirements.
The IT Director also periodically attends the Board’s Audit Committee meetings to report on developments impacting the IT Department and discuss annual cybersecurity goals and initiatives.
1 unchanged sentence
Our internal cybersecurity team is responsible for the development, implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Company.
−Removed: Reporting to our IT Director are experienced personnel with training to assist with managing cybersecurity objectives and to implement related policies and tools.
−Removed: Our internal cybersecurity team includes a manager who is a Certified Information Systems Security Professional and Systems Security Certified Practitioner.
+Added: Reporting to our IT Director are experienced personnel who assist with managing cybersecurity objectives and to implement related policies and tools.
Also, the internal cybersecurity team conducts periodic security awareness training for employees.
6 unchanged sentences
The Company takes a risk-based approach to manage cybersecurity risks and reviews third-party reports to oversee and identify cybersecurity threats.
−Removed: The Company maintains cybersecurity insurance to defray costs associated with an information security incident.
+Added: The Company maintains cybersecurity insurance to defray costs associated with a cybersecurity incident.
Security Policy and Requirements
7 unchanged sentences
(iv) reviewing and approving information security objectives on annual basis;
−Removed: and (v) driving continued improvement and communicate importance of information security to the organization.
+Added: and (v) driving continued improvement and communicating the importance of information security to the organization.
All Company employees, contractors, managers and partners are responsible for (i) following applicable information security controls and (ii) reporting violations of controls or suspicious incidents to their business manager or directly to the IT Department.
1 unchanged sentence
Incident Response
−Removed: We have implemented a Cybersecurity Incident Response Plan that applies in the event of a cybersecurity threat or incident (the “IRP”) to provide a standardized framework for responding to cybersecurity incidents.
+Added: We have implemented a Cybersecurity Incident Response Plan (the “IRP”) that applies in the event of a cybersecurity incident to provide a standardized framework for responses.
The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.
9 unchanged sentences
Despite ongoing efforts to continuously improve our and our vendors’ ability to protect against cyber incidents, we may not be able to protect all information systems.
−Removed: Cybersecurity incidents may lead to reputational harm, revenue and client loss, legal
−Removed: actions, and statutory penalties, among other consequences.
+Added: Cybersecurity incidents may lead to reputational harm, revenue and client loss, legal actions, and statutory penalties, among other consequences.
Additional information on cybersecurity risks we face are discussed in Item 1A “Risk Factors,” which should be read in conjunction with the foregoing information.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.