2 unchanged sentences
Assessing, identifying and managing data security, privacy and cybersecurity related risks are integrated into our overall enterprise risk management ("ERM") process, which considers all strategic, operational, compliance and financial risks across the organization.
−Removed: Our ERM process is conducted on an annual basis by our internal audit team through feedback from senior management, certain functional leaders and certain Board members.
+Added: Our ERM process is conducted on an annual basis by our internal audit team through feedback from senior management, certain functional leaders and certain members of the Board.
Risks are categorized as low, medium and high risks based on a quantitative and qualitative evaluation of how each risk could impact the Company's operations, current objectives and long-term strategies.
1 unchanged sentence
Low and medium risks are subject to various levels of internal monitoring.
−Removed: The annual risk assessment is reviewed with the Audit and Risk Committee and the Board of Directors.
+Added: The annual risk assessment is reviewed with the Audit and Risk Committee of the Board and the Board .
Our Audit and Risk Committee is responsible for the oversight of data security, privacy and cybersecurity related risks.
−Removed: Our CIO has a Bachelor of Science in Computer Engineering and over 26 years of experience in senior leadership privacy, information technology and cybersecurity oversight roles, including within the grocery retail industry.
+Added: Our Chief Information Officer ("CIO") has a PGDip in Computer Science, an MBA, a Master of Mathematics and over 20 years of experience in senior leadership information technology and cybersecurity oversight roles, including within the retail industry.
Our CIO reports to our Chief Operations Officer who also has decades of information technology experience, including with retailers such as Walmart, Inc., Family Dollar Stores, Inc.
7 unchanged sentences
As part of this process, we enhanced our security incident response procedures to address risks specific to remote working conditions.
−Removed: We continue to monitor and take reasonable actions intended to improve our security posture with process improvement, testing, simulation training and investments where necessary and appropriate for our company.
+Added: We continue to monitor and take reasonable actions intended to improve our security posture with process improvement, testing, simulation training and investments where necessary and appropriate for us.
We have a written incident response plan that is implemented by our cybersecurity incident response team, comprised of members of our information security, legal, human resources, finance and communications teams, and whose function is to respond to any such incident, define and seek to control the extent of the incident, assess and take reasonable actions intended to remediate any damage caused, and implement measures designed to prevent future reoccurrences.
4 unchanged sentences
In the future, we may not be successful in preventing or mitigating a cybersecurity incident that could ultimately have a material adverse effect on our business, operations and financial performance.
−Removed: We carry cyber risk insurance that provides protection against a breach or other data security incident, but such insurance may not be sufficient, and any related insurance proceeds may not be timely paid to us.
+Added: We carry cyber risk insurance that we believe provides protection against a breach or other data security incident, but such insurance may not be sufficient, and any related insurance proceeds may not be timely paid to us .
For more information about the cybersecurity risks we face, see the risk factors under the heading entitled "Risks Related to our Information Technology Systems, Data Protection and Cybersecurity" in "Item 1A.
−Removed: Risk Factors" of this Annual Report on Form 10-K.
+Added: Risk Factors" of this Form 10-K.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.