9 unchanged sentences
Our strategy for managing cybersecurity risk is multifaceted and includes, without limitation:
−Removed: (i) robust security policies and procedures, designed in part to comply with Payment Card Industry, or PCI, rules;
−Removed: (ii) an incident response plan, (iii) comprehensive system security elements and vulnerability scanning;
+Added: (i) robust security policies and procedures, designed in part to comply with the Payment Card Industry Data Security Standard (PCI-DSS), (ii) an incident response plan backed with industry-leading incident response support services, (iii) comprehensive system security vulnerability scanning, and oversight by a 24 hours a day, 7 days a week, 365 days a year Securities Operation Center;
(iv) periodic cybersecurity awareness training and testing for employees and certain contractors;
(v) risk management of our third-party suppliers, vendors, and other partners , which includes risk-based diligence and contractual provisions that generally allow for periodic auditing, and (vi) security assessments of any businesses that we acquire.
−Removed: As part of our cybersecurity risk management program, we periodically engage third parties to evaluate and test our systems, run tabletop exercises to test our incident response processes, provide incident response support if needed, and review our PCI compliance.
+Added: As part of our cybersecurity risk management program, we periodically engage third parties to evaluate and test our systems, run tabletop exercises to test our incident response processes, provide incident response support if needed, and certify our PCI-DSS compliance.
We face ongoing risks that, if realized, could materially impact our business, operations and financial results.
7 unchanged sentences
The Committee also periodically coordinates with the Company’s Audit Committee, which reviews risks related to the Company’s information technology systems, including privacy, network security and data security.
−Removed: The Company’s program to identify, assess, and manage cybersecurity risks is led by our Chief Information Officer, and leverages the expertise of our Chief Financial Officer and General Counsel.
−Removed: Our Chief Information Officer holds a Bachelor of Science in Computer Science and has over 30 years of work experience, with more than 20 years in senior executive roles involving managing information systems, including implementing effective information and cybersecurity programs.
−Removed: Our Chief Information Officer, who reports to our Chief Executive Officer, meets regularly with the executive leadership team regarding topics related to technology operations, including cybersecurity, and also periodically updates the Board and the Committee regarding the Company’s cybersecurity and data privacy risk mitigation plans.
−Removed: With respect to the prevention, detection, mitigation, and remediation of cybersecurity incidents, our information security team, under the direction of our Chief Information Officer, monitors our information systems, assesses the severity of any incidents it detects or that are otherwise reported, and follows escalation procedures embedded within our incident response plan to inform the Chief Information Officer, other members of management, the Committee, and the Board, each as needed.
+Added: The Company’s program to identify, assess, and manage cybersecurity risks is currently led by our Senior Vice President, IT Operations , and leverages the expertise of our Chief Financial Officer and General Counsel.
+Added: Our Senior Vice President, IT Operations holds a Bachelor of Business Administration in Business Computer Information Systems and has over 20 years of work experience, with more than 5 years in senior executive roles involving managing information systems, including implementing effective information and cybersecurity programs.
+Added: Our Senior Vice President, IT Operations, who reports to our Chief Executive Officer, meets regularly with the executive leadership team regarding topics related to technology operations, including cybersecurity, and also periodically updates the Board and the Committee regarding the Company’s cybersecurity and data privacy risk mitigation plans.
+Added: With respect to the prevention, detection, mitigation, and remediation of cybersecurity incidents, our information security team, under the direction of our Senior Vice President, IT Operations, monitors our information systems, assesses the severity of any incidents it detects or that are otherwise reported, and follows escalation procedures embedded within our incident response plan to inform the Senior Vice President, IT Operations, other members of management, the Committee, and the Board, each as needed.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.