4 unchanged sentences
Our cybersecurity risk management program (the “Cybersecurity Risk Management Program”) was designed to identify, manage, mitigate, and respond to ongoing cybersecurity threats and associated risks and is responsible for their escalation to the Board of Directors when determined to be material.
−Removed: Currently, the Cybersecurity Risk Management Program includes cybersecurity services provided by our Former Parent through 2024 as part a transition service agreement entered in connection with the Spin.
The underlying controls utilized by these programs are based on industry recognized best practices and standards for cybersecurity and information technology which include the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the International Organization for Standardization (ISO) 27001:2022 Information Security Management Systems Requirements.
6 unchanged sentences
• Reporting of risk issues deemed material to our Audit Committee of the Board of Directors
−Removed: Cybersecurity services, including, but not limited to, the following:
−Removed: • 24x7 Security services and Operations across (3) countries, including an Incident Response Plan and process.
+Added: Global Cybersecurity services, including, but not limited to, the following:
+Added: • 24x7 Security Operations and Incident Response
• Identity Access Management support and governance
2 unchanged sentences
• Annual and independent penetration testing and vulnerability scanning activities conducted by trusted third parties
−Removed: • Transition services provided by our Former Parent, as part of the Spin, effective June 2023 and through the exit of the transition service agreement
Third party risk management, including, but not limited to, the following:
3 unchanged sentences
Cybersecurity risks deemed material are then formally agreed upon as items to be reported by the Chief Information Security Officer (“CISO”) to the Audit Committee.
−Removed: Recognizing the cybersecurity and risk management programs are newly formed, we have established plans to conduct regular reviews and tabletop exercises to test processes for preparedness in case of a critical event as well as integrate cybersecurity risk with the Enterprise Risk Management Framework.
−Removed: As part of our risk management strategy, we have secured comprehensive cyber insurance coverage.
−Removed: We regularly review and update our cyber insurance coverage to align with the evolving nature of cyber threats and industry standards.
−Removed: Because we are a newly formed company, there are no historical internal or external assessment processes.
−Removed: Going forward, however, the Fortrea Internal Audit team will conduct internal assurance reviews as part of their 2024 annual audit plan.
−Removed: Additionally, as we continue to execute our risk management processes, we plan to engage external cybersecurity partners for the evaluation and assessment of our cybersecurity program and its capabilities.
−Removed: Although unknown cybersecurity risks could materialize as a result of risk factors identified during the Spin, we are not aware of any disclosures at this time which would be considered material risks and associated with cybersecurity threats or incidents.
−Removed: Refer to “Item 1A.
+Added: We have established plans to conduct periodic reviews and tabletop exercises to test various processes for preparedness in the event of a critical cybersecurity incident as well as include cybersecurity risk within our Enterprise Risk Management Framework.
+Added: As part of our overall risk management strategy, we have secured comprehensive cyber insurance coverage.
+Added: We regularly review and update our cybersecurity insurance coverage to align with the evolving nature of cyber threats and industry standards.
+Added: Fortrea will continue to leverage our internal audit department to provide independent reviews and recommendations to enhance Fortrea’s ability to manage risks effectively, as well as pursue external certifications.
+Added: Although unknown cybersecurity risks could materialize, including in connection with the implementation of independent systems following the Spin, we are not aware of any disclosures at this time which would be considered material risks and associated with cybersecurity threats or incidents.
+Added: Refer to Part I, Item 1A.
“Risk Factors” of this Annual Report on Form 10-K for further discussion of cybersecurity risks.
8 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.