5 unchanged sentences
This disclosure outlines our cybersecurity risk management approach, strategy, and governance structure.
−Removed: The Board and the Audit Committee of the Board (“Audit Committee”) are actively involved in oversight of our cybersecurity risk management.
−Removed: In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our security and the information that we collect as well as proactively identifying and preventing cybersecurity threats.
−Removed: Cybersecurity Risk Management and Strategy
−Removed: Our cybersecurity program is focused on protecting critical assets, including data, systems and applications;
+Added: Our cybersecurity risk management program is focused on protecting critical assets, including data, systems and applications;
minimizing the impact of cyberattacks;
2 unchanged sentences
• Governance:
−Removed: As discussed in more detail under the heading “Governance,” the Board delegated oversight of cybersecurity risk management to the Audit Committee, which regularly interacts with our Chief Information Security Officer (“CISO”), other members of management and relevant management committees and councils, including the Information Security Governance team and the Cybersecurity Risk Management team.
+Added: As discussed in more detail under the heading “Governance,” the Board delegated oversight of cybersecurity risk management to the Audit Committee, which regularly interacts with our Chief Information Officer (“CIO”), Chief Information Security Officer (“CISO”), other members of management and relevant management committees and councils, including the Information Security Governance team.
• Collaborative Approach:
4 unchanged sentences
• Incident Response and Recovery Planning:
−Removed: We have a dedicated Incident Response Team dedicated to responding to and recovering from cybersecurity incidents.
+Added: We have a dedicated Incident Response Team dedicated to responding to cybersecurity incidents.
• Third-Party Risk Management:
2 unchanged sentences
We provide regular training for all employees and contractors, which is designed to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.
−Removed: We regularly identify and assess cybersecurity risks through a comprehensive program that includes:
+Added: The Board and the Audit Committee of the Board (“Audit Committee”) are actively involved in oversight of our cybersecurity risk management program.
+Added: We seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on protecting our security and the information that we collect as well as proactively identifying and preventing cybersecurity threats.
+Added: Risk Management and Strategy
+Added: We regularly identify and assess cybersecurity risks by applying our cybersecurity risk management program processes, including:
• Vulnerability assessments and penetration testing:
9 unchanged sentences
We assess the legal and regulatory risks associated with cybersecurity incidents and ensure compliance with applicable laws and regulations.
−Removed: As discussed above, our cybersecurity governance structure is integrated into several facets of us, which include:
+Added: Our cybersecurity governance facilitates coordination between the necessary cybersecurity risk assessment and response personnel, including:
• Board of Directors:
−Removed: The Board has ultimate oversight responsibility for cybersecurity.
+Added: The Board has ultimate oversight responsibility for our cybersecurity risk management program.
The Board has delegated to the Audit Committee the responsibility for monitoring and overseeing our cybersecurity and other information technology risks, controls, strategies and procedures.
1 unchanged sentence
The Audit Committee is responsible for monitoring the effectiveness of our information system controls and security, including a periodic review of our cybersecurity and other information technology risks, controls, initiatives and action plans.
+Added: • Information Security Governance Team :
+Added: The Information Security Governance Team is comprised of senior executives who oversee the development and implementation our cybersecurity strategy.
• Chief Information Security Officer (CISO):
−Removed: Casey O’Malley is our CISO and is responsible for the day-to-day management of the cybersecurity program.
−Removed: Casey has had a distinguished career holding IT leadership positions since 2015 and has been employed in the cybersecurity field since 2001 .
−Removed: • Information Security Governance:
−Removed: The Information Security Governance team is comprised of our senior executives and oversees the development and implementation of the cybersecurity strategy.
−Removed: • Cybersecurity Risk Management Team:
−Removed: The Cybersecurity Risk Management Team is responsible for identifying, assessing, and mitigating cybersecurity risks.
+Added: The CISO is responsible for the day-to-day management of our cybersecurity program.
• Incident Response Team:
−Removed: The Incident Response Team is responsible for responding to and recovering from cyberattacks.
−Removed: The management team reports to the Board on cyber risk quarterly.
+Added: The Incident Response Team is responsible investigating potential cyber incidents and for responding to and recovering from any actual cyberattacks.
+Added: The Information Security Governance Team reports to the Board on cybersecurity risk quarterly.
Reports include:
7 unchanged sentences
Plans and investments for maintaining and enhancing our cybersecurity program.
−Removed: The management team is required to update the Board immediately once a material breach occurs.
−Removed: The Board is provided timely updates until the incident is considered resolved.
−Removed: Management evaluates cyber incidents based on their materiality, considering factors such as:
−Removed: • Financial impact:
−Removed: Potential losses in revenue, profits, or assets.
−Removed: • Reputational damage:
−Removed: Impact on our brand image and customer trust.
−Removed: • Regulatory compliance concerns:
−Removed: Potential violations of data privacy regulations or other legal requirements.
−Removed: • Operational disruption:
−Removed: Impact on business continuity and ability to deliver services.
−Removed: Based on the materiality assessment, we determine the appropriate disclosure to regulatory agencies, stakeholders, and the public, ensuring transparency and minimizing potential harm.
+Added: While we have not experienced any material cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, as of the date of this Annual Report on Form 10-K, there can be no guarantee that we will not be the subject of future threats or incidents.
+Added: Additional information on cybersecurity risks we face can be found in Item 1A, Risk Factors, which should be read in conjunction with the foregoing information.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.