6 unchanged sentences
The Audit Committee receives regular updates specific to the company’s cyber security program and IT security risk, including threat protection posture, IT compliance reporting, and IT risk posture.
−Removed: The Board of Directors ("Board") has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO.
+Added: The Board has ultimate oversight for risks relating to our information security program and practices and receives periodic updates from the Audit Committee Chair on cybersecurity and IT security risk and mitigation strategies, as well as periodic updates directly from the CIDO and CISO.
Our program is regularly evaluated by internal and external resources with the results of those reviews reported to senior management, the Audit Committee and the Board.
We also actively engage with key vendors, industry participants, and intelligence and law enforcement communities for benchmarking and awareness of best practices as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.
−Removed: As part of our cybersecurity risk management system, our governance, risk and compliance team tracks and logs privacy and security incidents across GPC as well as performs third-party risk management to identify and mitigate risks from third parties such as vendors and suppliers.
+Added: part of our cybersecurity risk management system, our governance, risk and compliance team tracks and logs privacy and security incidents across GPC as well as performs third-party risk management to identify and mitigate risks from third parties such as vendors and suppliers.
The results of our evaluations and the feedback from our engagements are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity strategies, policies, and processes and make recommendations to improve processes.
3 unchanged sentences
The incident response plan is periodically evaluated by our cybersecurity team as well as by independent advisors using simulated security exercises.
+Added: Our incident response protocols, developed in coordination with our legal department, establish defined processes to assessing whether a cybersecurity incident constitutes as a material event and may require disclosure with the U.S.
+Added: Securities and Exchange Commission.
Security awareness training is also key component of our information security program and involves required training for all our teammates and contingent workers.
−Removed: Although we have not experienced a material breach of cybersecurity to date, our computer systems and the computer systems of our third-party service providers have been, and will likely continue to be, subjected to unauthorized access or phishing attempts, computer viruses, malware, ransomware or other malicious codes.
+Added: Although we do not believe we have experienced a material breach of cybersecurity to date and do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us as of the date of this Form 10-K, our computer systems and the computer systems of our third-party service providers have been, and will likely continue to be, subjected to unauthorized access or phishing attempts, computer viruses, malware, ransomware or other malicious codes.
+Added: Cybersecurity attacks are constantly evolving, may be difficult to detect quickly, and often are not recognized until after they have been launched against a target.
Despite our security measures, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.