3 unchanged sentences
The Company’s cybersecurity program is designed to protect its digital assets and information, and to allow for the secure storage and transmission of proprietary or confidential information regarding our customers, employees, job applicants, and other parties, including financial information, intellectual property, and personal identification information.
−Removed: The Company’s cybersecurity program is formed on a risk-based approach in accordance with industry best practices, and is calibrated with recommendations from third party risk management consultants , auditors, cybersecurity professionals, and cybersecurity insurers.
−Removed: Portions of our business are certified under the Cyber Essentials program.
−Removed: Additionally, the Company has performed an ISO 27001 gap analysis and goals have been set forth to comply with ISO 27001 company-wide.
+Added: The Company’s cybersecurity program is formed on a risk-based approach in accordance with industry best practices, and is calibrated with recommendations from third
+Added: party risk management consultants , auditors, cybersecurity professionals, and cybersecurity insurers.
+Added: Portions of our business are certified under the Cyber Essentials Plus program.
+Added: Additionally, the Company has performed an ISO 27001 gap analysis, with the goal to adhere to ISO 27001 standards as a guidepost for a Company-wide security posture.
Our cybersecurity program includes:
• a comprehensive cyber education program with ongoing employee cybersecurity awareness and training activities, which include frequent phishing simulation, testing, and ongoing education;
+Added: • strong identity and authentication controls with multifactor authentication and risky user detection;
• access management and access controls with periodic reviews;
• protection of certain data through encryption at rest and in transit;
+Added: • application whitelisting ensuring unapproved applications cannot be run;
• endpoint and network monitoring and protection software;
+Added: • network segmentation to prohibit lateral motion;
• sensitive data transmission detection tools;
+Added: • comprehensive AI governance, training, detection, and whitelisting only approved applications evaluated by Information Technology (“IT”) Security and Compliance and Legal;
• the engagement of a managed detection and response service which monitors the Company’s environment at all times for threats, and in the event of an incident, provides proactive services;
4 unchanged sentences
• integrating cybersecurity requirements and other provision into various contracts.
−Removed: The Company has continued to invest in cybersecurity to evolve and improve its program and regularly assesses and measures itself against industry practices to identify opportunities to enhance training and awareness among our people and improve processes
−Removed: T able of Contents
−Removed: and technology used to identify, prevent, detect, respond, and recover from cybersecurity incidents.
+Added: The Company has continued to invest in cybersecurity to evolve and improve its program and regularly assesses and measures itself against industry practices to identify opportunities to enhance training and awareness among our people and improve processes and technology used to identify, prevent, detect, respond, and recover from cybersecurity incidents.
When such improvements are identified and validated as appropriate in the Company’s business context, they are incorporated in the roadmap for implementation.
8 unchanged sentences
Foster Company, which includes cybersecurity risks.
−Removed: The Audit Committee of the Board (the “Audit Committee”), is responsible for oversight of the Company’s Enterprise Risk Management (“ERM”) program which provides oversight and governance of all of the Company’s operational and financial risks, specifically including risks from cybersecurity threats to the Company.
+Added: The Audit Committee of the Board (the “Audit Committee”), is responsible for oversight of the Company’s Enterprise Risk Management program which provides oversight and governance of all of the Company’s operational and financial risks, specifically including risks from cybersecurity threats to the Company.
As described below, the Audit Committee receives regular reports and periodic briefings from senior management on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities.
+Added: Recent areas of attention have included AI-related threats and opportunities with discussions focused on proactive risk management and emerging developments in the AI landscape.
The Company has a Cyber Incident Response Team (“CIRT”) of trained information technology professionals who are responsible for assessing, identifying, and managing our material risks from cybersecurity threats on an ongoing basis, all of whom have extensive background, experience, and education in information technology and computer science and are subject to training on industry-leading security platforms and tools as well as continuing education to maximize capabilities with the tools and technology of the Company.
−Removed: This team is overseen by the Vice President of Information Technology , who facilitates the regular cybersecurity updates to the Audit Committee.
+Added: This team is overseen by the Vice President of Information Technology , who facilitates the regular cybersecurity updates to the Audit
The Company also has a Cyber Security Materiality Assessment Committee (“CMAC”) comprised of the Chief Financial Officer, General Counsel, and information technology and security representatives, which is responsible for assessment of material cybersecurity incidents and communicating such incidents to the Chief Executive Officer, Audit Committee, and the Board .
1 unchanged sentence
This communication hierarchy includes protocols for informing the Chief Executive Officer, Audit Committee, and the full Board of certain cybersecurity events or incidents and for determining the materiality thereof.
−Removed: T able of Contents
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.