4 unchanged sentences
We believe our program’s control focus provides immediate protection and scalability for our business.
−Removed: Our program defines our governance and management oversight, and includes (i) continual training to raise user vigilance and resistance to phishing attempts and cyber-attacks, (ii) evaluation of compliance with privacy and data security regulations and (iii) reporting obligations in the event of an incident.
+Added: Our program defines our governance and management oversight, and includes (i) continual training to enhance user vigilance and resistance to phishing attempts and cyber-attacks, (ii) evaluation of compliance with privacy and data security regulations and (iii) reporting obligations in the event of an incident.
As part of our program, we partner with a security operations center for continuous monitoring and alerting across all of our information technology systems.
−Removed: Annually, we engage external consultants to evaluate the effectiveness of our cybersecurity program and recommend improvements.
+Added: Additionally, our Information Technology leadership meets monthly with a cyber advisor to review progress on tools, scoring and management of our cybersecurity programs.
+Added: On an annual basis, we engage an external partner to conduct a comprehensive risk assessment of our cybersecurity program, identify gaps based on best practices and recommend improvements.
We have also developed vendor scoring criteria to assess cybersecurity, incidence readiness and cyber insurance of our critical vendors and service providers.
+Added: Additionally, we conduct ongoing internal and external vulnerability and penetration scans.
+Added: Our internal security team is led by a manager with over 40 years of experience who reports directly to our Chief Information Officer.
Security incidents or breaches have from time to time occurred and may in the future occur involving our systems, the systems of the parties with whom we communicate or collaborate (including franchisees) or the systems of third-party providers.
−Removed: Incidents or breaches have from time to time occurred and may in the future occur involving our systems, the systems of the parties with whom we communicate or collaborate (including franchisees) or the systems of third-party providers.
As of the date of this Annual Report on Form 10-K, we have not experienced cybersecurity threats or incidents that have materially affected us.
4 unchanged sentences
The Audit Committee of our Board is tasked with oversight of certain risk issues, including cybersecurity.
−Removed: The Audit Committee receives reports on cybersecurity at least annually from the Company’s SVP, Informational Technology, who has over 25 years of experience in the management of information technology systems and cybersecurity.
+Added: T he Audit Committee receives reports on cybersecurity at least twice annually from the Company’s Chief Information Officer, who has over 25 years of experience in the management of information technology systems and cybersecurity.
+Added: These reports cover trends vulnerability management, cybersecurity posture, risk assessment findings, incident responses and updates on technology initiatives.
The Audit Committee briefs the full Board of Directors on these matters as a part of its reports of its meetings.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.