2 unchanged sentences
Risk Management and Strategy
−Removed: The Company's cybersecurity objective is to protect Garrett against data privacy breaches, information theft, and external and insider cyber threats through the use of a combination of leading technologies, policies, and procedures.
−Removed: The Company has processes in place to identify, assess and monitor material risks from cybersecurity threats, which are part of the Company’s overall enterprise risk management ("ERM") process and have been embedded in the Company’s operating procedures, internal controls and information systems.
+Added: Our cybersecurity objective is to protect against data privacy breaches, information theft, and external and insider cyber threats through the use of a combination of cyber technologies, policies, and procedures.
+Added: We have processes to identify, assess, monitor and mitigate material risks from cybersecurity threats, which are part of the Company’s overall enterprise risk management ("ERM") process and have been embedded in the Company’s operating procedures, internal controls and information systems.
To that end, we take a holistic approach to securing our data and business systems from attack, compromise or loss.
−Removed: The Company has cybersecurity capability, including a Security Operations Center ("SOC") that is managed by a dedicated Chief Information Security Officer (“CISO”) whose team is responsible for leading the Company-wide cybersecurity strategy, policy, standards, architecture, and processes.
−Removed: The SOC provides visibility across all information technology assets and includes proactive cyber security threat detection technology to facilitate the identification of misconfigurations to mitigate threats and prevent data loss.
+Added: The Company has cybersecurity capability that is managed by a dedicated Chief Information Security Officer (“CISO”) whose team is responsible for leading the Company-wide cybersecurity strategy, policy, standards, architecture, and processes.
+Added: The Security Operations Center ("SOC") provides visibility across all information technology assets and includes proactive cyber security threat detection technology to facilitate the identification of misconfigurations to mitigate threats and prevent data loss.
As part of the Company’s holistic approach to cybersecurity, we have implemented programs and technology associated with threat hunting, vulnerability scanning, and threat detection and response technology.
1 unchanged sentence
This training is mandatory for all employees globally on a regular basis and may be supplemented by various testing initiatives including periodic phishing tests.
−Removed: The Company leverages third-party expertise for periodic effectiveness testing of its prevention, detection, and response capabilities.
−Removed: The Company also requires all third-party service providers to meet certain cybersecurity requirements, including risk assessment and monitoring activities.
−Removed: In addition, third-party service providers with access to the Company's network are also required to undertake cybersecurity training.
+Added: The Company uses third-party expertise for periodic effectiveness testing of its prevention, detection, and response capabilities.
+Added: The Company also requires all third-party service providers to meet specific cybersecurity requirements, including risk assessment and monitoring activities.
+Added: In addition, third-party service providers with access to the Company's network have additional obligations including a requirement to undertake cybersecurity training.
While Garrett focuses heavily on prevention and detection, response and recovery plans, service agreements and partner engagements are in place should there be a need for us to respond to a cybersecurity attack.
9 unchanged sentences
Role of Management
−Removed: The Company has a Cyber Risk Governance Council consisting of the Senior Vice President Chief Digital and Information Officer (“CDIO”), the CISO, the IT leadership team, and the legal and cybersecurity teams that focuses on cybersecurity and compliance risks.
−Removed: The Cyber Risk Governance Council meets monthly to review cybersecurity risks and related risk management methodologies.
+Added: The Company has a Cyber Risk Governance Council consisting of the Senior Vice President Chief Digital and Information Officer (“CDIO”), the CISO, the IT leadership team, and the cybersecurity team that focuses on cybersecurity and compliance risks.
+Added: The Cyber Risk Governance Council meets periodically to review cybersecurity risks and related risk management methodologies.
Cybersecurity risks are included in the Company’s ERM as appropriate based on potential impact and vulnerability assessed according to certain set criteria and defined ERM materiality thresholds.
−Removed: Regular discussions over cybersecurity developments and risk mitigation approaches are held by the Cyber Risk Governance Council with the Chief Executive Officer and the senior leadership team.
−Removed: The CISO has over 27 years of experience in IT in various capacities with over 21 years in cybersecurity, reporting into the CDIO, who has over 20 years of IT related experience.
+Added: Regular discussions of cybersecurity developments and risk mitigation approaches are held by the CDIO & CISO with the Chief Executive Officer and the senior leadership team.
+Added: The CISO has over 28 years of experience in IT in various capacities with over 22 years in cybersecurity, reporting to the CDIO, who has over 20 years of IT related experience.
Role of the Board
−Removed: The Board of Directors is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess, manage and mitigate risk.
+Added: The Board of Directors is responsible for overseeing overall risk management for the Company, including review and approval of the enterprise risk management approach and processes implemented by management to identify, assess,
+Added: manage and mitigate risk.
The Board has delegated responsibility for oversight of the Company's cybersecurity framework and risk management to the Audit Committee.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.