8 unchanged sentences
(i) an Information Security Incident Response Procedure (the “Incident Response Procedure”), which delineates the processes for reporting, classifying, investigating, planning, containing, eradicating, recovering, documenting, and communicating information security incidents, as well as post-incident activities;
−Removed: and (ii) a Security Monitoring Policy, which establishes the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or
−Removed: manual), as well as various condition monitoring tests and reviews, and documentation requirements in connection with security incident identification.
+Added: and (ii) a Security Monitoring Policy, which establishes the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual), as well as various condition monitoring tests and reviews, and documentation requirements in connection with security incident identification.
Potential information security incidents are identified in a number of ways, including, but not limited to:
17 unchanged sentences
The CIO reports to the President and Chief Executive Officer, while the DIS reports to the Chief Regulatory Officer and reports regularly to the Audit Committee.
−Removed: The CIO has 20 years of industry experience including management of technology, security, data analytics, and vendor relationships.
−Removed: The DIS has over 10 years of industry experience and 25 years of information security experience focusing on management of security and vendor relationships.
+Added: The CIO has over 20 years of industry experience including management of technology, security, data analytics, and vendor relationships.
+Added: The DIS has over 10 years of industry experience and over 25 years of information security experience focusing on management of security and vendor relationships.
The DIS also possesses several industry certifications, including certification as a Certified in Risk and Information Systems Control and Certified Information Security Manager from the Information System Audit and Control Association.
13 unchanged sentences
Members of the Audit Committee of our board of directors receive presentations as well as minutes of the meetings of our information technology steering committee on a quarterly basis.
−Removed: Our information technology steering committee consists of members of our board of directors who have relevant experience from their audit and management experience as well as training provided by our management.
+Added: Our information technology steering committee consists of members of management who have relevant experience as well as industry training.
If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors and/or the Audit Committee sooner than its next quarterly update.
11 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.