2 unchanged sentences
Rapidly evolving threats to the cybersecurity landscape necessitate ongoing efforts to manage the risk of unauthorized access to the Company’s information systems and devices, including those of the Company and of third-party providers.
−Removed: The Company is subject to laws and rules issued by multiple government agencies concerning safeguarding and maintaining the confidentiality of our security, customer, and business information.
−Removed: The company employs various aspects of risk assessment regularly, and to the extent possible, continuously.
+Added: The Company is subject to laws and rules issued by multiple government agencies concerning safeguarding and maintaining the confidentiality of its security, customer and business information.
+Added: The Company employs various aspects of risk assessment regularly, and to
+Added: the extent possible, continuously.
Further, the Company uses a defense in depth, or layered, approach to strengthen the security environment and mitigate the impact of any potential threats.
Cybersecurity risks are strategically managed under the leadership of the Vice President, IT Operations and Security , who has achieved preeminent certification as a Certified Information Security Manager (CISM) and Certified Cloud Security Professional (CCSP) and has served as the most senior IT resource in many different roles.
−Removed: Management regularly assesses new and emerging risks by keeping apprised of current events and actual or anticipated threats within the industry and the overall security environment, which is used along with a risk-based approach to plan and implement changes or improvements to the security environment.
+Added: Management regularly assesses new and emerging risks by keeping apprised of current events and actual or anticipated threats within the industry and the overall security environment, which are used along with a risk-based approach to plan and implement changes or improvements to the security environment.
The Company has engaged independent experts to assess the security environment for potential vulnerabilities or weaknesses and has plans for future engagements periodically to supplement the expertise and processes established within the Company.
−Removed: Thorough updates are provided to the board of directors quarterly by the Vice President, Information Technology (IT) Operations and Security.
+Added: Thorough updates are provided to the board of directors quarterly by the Vice President, IT Operations and Security .
The directors may ask questions or engage in further discussion related to the security environment.
5 unchanged sentences
The Company has also established an incident response policy that thoroughly and systematically documents the Company’s response and assigns responsibility to facilitate timely, organized and appropriate action during a security event or incident, including assessment of the impact and materiality of the event or incident.
−Removed: Incident management is led by the
−Removed: Table of Con tents
−Removed: Security Incident Response Team, under the primary leadership of the Vice President, IT Operations and Security, in which the process is categorized by the detection, analysis, containment, eradication and recovery phases and is inclusive of post-incident activities.
−Removed: In the regular course of our business, the Company manages a range of sensitive security, customer, and business systems information.
−Removed: A security breach of our information systems such as theft or the inappropriate release of certain types of information, including confidential customer, employee, financial or system operating information, could have a material adverse impact on our financial condition, results of operations or cash flows.
−Removed: The Company operates in a highly regulated industry that requires the continued operation of sophisticated information technology systems and network infrastructure.
−Removed: Despite implementation of security measures, the technology systems are vulnerable to disability, failures or unauthorized access.
−Removed: Facilities, information technology systems and other infrastructure facilities and systems and physical assets could be targets of such unauthorized access.
−Removed: Failures or breaches of our systems could impact the reliability of systems and also subject the Company to financial harm.
−Removed: If the technology systems were to fail or be breached and if the Company is unable to recover in a timely way, fulfilling critical business functions and sensitive confidential data could be compromised, which could have a material adverse impact on the Company’s financial condition, results of operations or cash flows.
−Removed: The Company has experienced, and expects to continue experiencing, these types of threats and attempted intrusions.
−Removed: The implementation of additional security measures could increase costs and have a material adverse impact on the Company’s financial results.
−Removed: Cyber insurance has been obtained to provide coverage for a portion of the losses and damages that may result from a security breach of information technology systems, but such insurance may not cover the total loss or damage caused by a breach.
−Removed: In addition, all costs of responding to and recovering from a cyber incident may not be covered by insurance.
−Removed: These types of events could also require significant management attention and resources, and could adversely affect the Company’s reputation with customers and the public.
−Removed: As operators of critical infrastructure, the Company may face a heightened risk of cyberattacks from internal or external sources.
−Removed: Unauthorized access to confidential information located or stored on these systems could negatively and materially impact customers, employees, suppliers and other third parties.
−Removed: Further, third parties, including vendors, suppliers and contractors, who perform certain services or administer and maintain our sensitive information, could also be targets of cyberattacks and unauthorized access.
−Removed: While the Company has instituted safeguards to protect the information technology systems, those safeguards may not always be effective due to the evolving nature of cyberattacks and cyber vulnerabilities.
−Removed: The Company cannot guarantee that such protections will be completely successful in the event of a cyberattack.
−Removed: If the information technology systems, or that of third parties on which the Company relies, are affected by a significant cyber breach, this could result in, among other things, a significant disruption to operations;
−Removed: costly investigations and remediation;
−Removed: misappropriation of confidential information of the Company or that of customers, employees, business partners or others;
−Removed: litigation and potential liability;
−Removed: enforcement actions and investigations by regulatory authorities;
−Removed: loss of customers and contracts;
−Removed: harm to reputation;
−Removed: and a loss of management time, attention and resources from regular business operations, any of which could have a negative impact on business, results of operations, and cash flows.
−Removed: As previously discussed, the Company is subject to laws and rules issued by multiple government and private agencies concerning safeguarding and maintaining the confidentiality of our security, customer, and business information.
−Removed: The increasing promulgation of rules and standards will increase our compliance costs and our exposure to the potential risk of violations of the standards.
−Removed: Table of Con tents
+Added: Incident management is led by the Security Incident Response Team, under the primary leadership of the Vice President, IT Operations and Security, in which the process is categorized by the detection, analysis, containment, eradication and recovery phases and is inclusive of post-incident activities .
+Added: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
+Added: For additional information regarding cybersecurity-related risks we face, see “Risk Factors—Technology Factors—Our information technology systems may be vulnerable to unauthorized external or internal threats due to hacking, ransomware, viruses or other cybersecurity breaches,” included in Part I, Item 1A of this report.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.