5 unchanged sentences
Our Cyber Security Initiative (“CSI”) committee led by our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization.
−Removed: The Information Security Officer reports directly to the Chief Operating Officer and, as discussed below, regularly to the Risk and Compliance Committee of our board of directors.
+Added: The Information Security Officer reports directly to the Managing Director of Operations and, as discussed below, regularly to the Risk and Compliance Committee of our board of directors.
Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information.
6 unchanged sentences
We also employe a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on suspected advanced persistent threats.
−Removed: have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests.
−Removed: We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists.
+Added: We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests.
+Added: We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts, penetration testers, and third-party specialists .
We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain.
We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely.
+Added: We have optimized our vulnerability management program that scans devices every four hours, and we have strict key performance metrics to ensure vulnerabilities are remediated quickly.
We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.
We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and the Risk and Compliance Committee of our board of directors.
−Removed: The Incident Response Plan is coordinated through the Management Director of Information Technology and key members of management are embedded into the Plan by its design.
+Added: The Incident Response Plan is coordinated through the Chief Operating Officer and key members of management are embedded into the Plan by its design.
The Incident Response Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.
8 unchanged sentences
Individuals within the Committee are generally subject to professional education and certification requirements.
−Removed: In particular, our Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.
−Removed: Our board of directors has approved management commitess including the CSI Committee, which focuses on technology impact, and the Management Risk Committee, which focuses on business impact.
+Added: In particular, our Information Security Officer has the necessary relevant expertise and formal training in the areas of information security and cybersecurity risk management.
+Added: Our board of directors has approved management committees including the CSI Committee, which focuses on technology impact, and the Risk Management Committee, which focuses on business impact.
These committees provide oversight and governance of the technology program and the information security program.
−Removed: These committees are chaired by managers within the Corporation and include the Chief Operating Officer, as well as his direct reports and other key departmental managers from throughout the entire company.
+Added: There are also three technology steering committees that plan and guide technology projects in alignment with the Corporation’s strategic plan.
+Added: These committees are chaired by managers and experts within the Corporation and include the Chief Operating Officer, as well as his direct reports and other key departmental managers from throughout the entire company.
These committees generally meet regularly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation to facilitate timely information and monitoring efforts.
1 unchanged sentence
The Risk and Compliance Committee of our board of directors is responsible for overseeing our information security and technology programs, including management’s actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks.
−Removed: Our CSI Committee provides quarterly reports to the Risk and Compliance
−Removed: Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.
+Added: Our CSI Committee provides quarterly reports to the Risk and Compliance Committee of our board of directors regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.
The Risk and Compliance Committee of our board of directors reviews and approves our information security and technology budgets and strategies annually.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.