4 unchanged sentences
The Company has established a Cybersecurity Incident Response Team (the “CIRT”) to develop and continually enhance a cyber incident response plan, which guides the Company in identification, containment, eradication and recovery from cybersecurity incidents.
−Removed: The CIRT is charged with the evaluation and implementation of incident response tools, and the implementation of training procedures and exercises to mitigate and remediate potential cybersecurity incidents.
−Removed: The CIRT members are comprised of representatives from management, including the Company’s Chief Executive and Financial Officers, information technology, legal and communications teams and reports to the Risk & Sustainability Committee of the Company’s Board of Directors, which is tasked with oversight of the general risk and sustainability programs of the Company.
+Added: The CIRT is led by the Company’s Director of Information Technology (the “Director of IT”), who reports to the Company’s Chief Financial Officer.
+Added: The Director of IT has a formal education in Computer Information Systems and is a Microsoft Certified Information Systems Professional with 28 years of experience.
+Added: The Director of IT has comprehensive experience in cybersecurity controls, including intrusion detection, network security, operating systems, incident response and a track record of identifying cyber risks and implementing countermeasures to mitigate cyber attacks.
+Added: The CIRT is charged with the evaluation and implementation of incident response tools, and the implementation of mandatory training procedures and exercises to mitigate and remediate potential cybersecurity incidents.
+Added: The CIRT members are comprised of representatives from management, including the Company’s Chief Executive and Financial Officers, information technology, legal and communications teams.
+Added: The CIRT reports to the Risk & Sustainability Committee of the Company’s Board of Directors, which is tasked with oversight of the general risk and sustainability programs of the Company.
The Board has an active role in overseeing management of the Company’s risks and regularly reviews information regarding the Company’s operations, liquidity and associated risks.
1 unchanged sentence
The Company uses several real-time systems for detecting potential threats to its systems, devices and user accounts.
+Added: In addition, the Company reviews controls implemented by its third-party service providers to ensure that the providers’ controls have been designed to effectively mitigate cybersecurity risks that could affect the Company’s systems.
The Company also engages third-party consultants to evaluate its security and disclose any potential weaknesses within the Company’s systems.
−Removed: The CIRT will review the steps required to minimize the effects of any discovered weaknesses and implement changes as deemed necessary.
+Added: The CIRT reviews the findings of these evaluations and will determine the steps required to minimize the effects of any discovered weaknesses and implement changes as deemed necessary.
The Company’s information technology team is tasked with the initial assessment of a suspected incident and evaluates the suspected incident based on the Company’s cybersecurity policy.
4 unchanged sentences
See “Risk Factors” in Item 1A of this Annual Report.
−Removed: December 31, 2023, we have not identified any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.
+Added: As of December 31, 2024, we have not identified any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.