4 unchanged sentences
Risks are categorized as low, medium and high risks based on a quantitative and qualitative evaluation of how each risk could impact the Company's operations, current objectives and long-term strategies.
−Removed: Each high risk is assigned to a member of senior management as the risk owner and the Board or a Board Committee for oversight, with the risk owner developing a risk mitigation plan that is tracked to completion.
+Added: Each high risk is assigned to a member of senior management as the risk owner and the Board or a Board Committee for oversight, with the risk owner implementing a risk mitigation plan.
Low and medium risks are subject to various levels of internal monitoring.
−Removed: The annual risk assessment is reviewed with the Audit and Risk Committee of the Board and the Board .
+Added: The ERM is presented annually to the Audit and Risk Committee of the Board by our internal audit team and is reviewed with the Board by our Chairman of the Audit and Risk Committee.
Our Audit and Risk Committee is responsible for the oversight of data security, privacy and cybersecurity related risks.
Our Chief Information Officer (" CIO ") has a PGDip in Computer Science, an MBA, a Master of Mathematics and over 20 years of experience in senior leadership information technology and cybersecurity oversight roles, including within the retail industry.
−Removed: Our CIO reports to our Chief Operations Officer who also has decades of information technology experience, including with retailers such as Walmart, Inc., Family Dollar Stores, Inc.
−Removed: and Gap, Inc.
+Added: Our CIO reports to our Chief Executive Officer and presents an assessment of risks to the Audit and Risk Committee.
Under the direction of our information technology department, we have implemented policies and controls in line with the requirements of the International Organization for Standardization and have assessed our cybersecurity maturity levels against the National Institute of Standards and Technology framework to set appropriate standards and guidelines.
2 unchanged sentences
We have an onboarding and periodic security review process of all third-party vendors who have or will have access to our confidential information.
−Removed: We also have established business continuity disaster recovery plans that are designed to limit downtime and data loss in the event of a security breach.
−Removed: As we have increased our remote workforce in recent years, the Audit and Risk Committee and management have focused on enhancing the security of remote access with trusted devices, endpoint security controls and infrastructure resiliency.
+Added: As we have increased our remote working capabilities in recent years, the Audit and Risk Committee and management have focused on enhancing the security of remote access with trusted devices, endpoint security controls and infrastructure resiliency.
As part of this process, we enhanced our security incident response procedures to address risks specific to remote working conditions.
6 unchanged sentences
In the future, we may not be successful in preventing or mitigating a cybersecurity incident that could ultimately have a material adverse effect on our business, operations and financial performance.
−Removed: We carry cyber risk insurance that we believe provides protection against a breach or other data security incident, but such insurance may not be sufficient, and any related insurance proceeds may not be timely paid to us .
+Added: We carry cyber risk insurance that we believe provides a level of financial protection against potential losses arising from a breach or other data security incident, but such insurance may not be sufficient, and any related insurance proceeds may not be timely paid to us .
For more information about the cybersecurity risks we face, see the risk factors under the heading entitled "Risks Related to our Information Technology Systems, Data Protection and Cybersecurity" in "Item 1A.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.