1 unchanged sentence
Cybersecurity.
−Removed: We believe that cybersecurity is fundamental to how we operate and as such we focus on defining and managing our cybersecurity risk.
+Added: We believe that cybersecurity is fundamental to how we operate and as such we place significant focus on defining and managing our cybersecurity risk.
With the ever-changing cybersecurity landscape and continual emergence of new threats, our Board of Directors, Audit Committee and senior management team ensure that significant resources are devoted to cybersecurity risk management and the technologies, processes and people that support it.
−Removed: We have an Enterprise Risk Management Committee, comprising senior leaders from key functions, and a Cybersecurity Risk Committee which utilize the National Institute of Standards and Technology (“NIST”) framework to ensure that these risks are clearly and effectively categorized and treated.
+Added: We have an Enterprise Risk Management Committee, comprising senior leaders from key functions, and a Cybersecurity Risk
+Added: Committee which utilize the National Institute of Standards and Technology (“NIST”) framework to ensure that these risks are clearly and effectively categorized and treated.
We utilize comprehensive and widespread information sources and services (including third-party threat intelligence) to understand the threat landscape faced by the Company and design our protective controls accordingly using a defense-in-depth approach.
The layers of these defenses are aligned to the NIST framework;
−Removed: Identify, Protect, Detect, Respond and Recover.
+Added: Govern, Identify, Protect, Detect, Respond and Recover.
The Enterprise Risk Management Committee and Cybersecurity Risk Management Committee meet regularly to consider any change to risk levels and ensure that the Company’s cybersecurity controls remain commensurate to those risk levels.
+Added: These controls and their performance are constantly evaluated and evolved to ensure that the Company remains well protected against any new threats.
The Company’s Chief Information Security Officer (“CISO”) is responsible for developing and implementing our cybersecurity program and reporting on related matters to our Board of Directors.
−Removed: The CISO has over a decade of experience leading cybersecurity functions and over two decades in cybersecurity.
+Added: The CISO has over two decades of cyber security experience in a variety of industries including banking, aerospace, manufacturing and defense.
+Added: A decade of this experience has been in senior leadership roles.
The CISO leads a global team of highly trained experts covering all major cybersecurity functions including Technical Engineering and Architecture, Governance Risk and Compliance, Security Operations and Incident Response, Threat and Vulnerability Management and Security Awareness.
4 unchanged sentences
All Company employees are required to complete cybersecurity training annually, with quarterly “refreshers” throughout the year.
+Added: An advanced phishing simulation program exists at the Company and all employees are tested at least monthly on their ability to identify phishing emails.
We invest in our cybersecurity defenses and have implemented multiple layers of protection against all known critical threats.
We have high levels of compliance to protective controls on our technical estate, robust perimeter defenses, industry-leading filtering and analysis of web and email traffic, widespread multi-factor authentication, continuous training of our employees through educational material or simulation (e.g., phishing) and 24/7 monitoring of the IT estate.
−Removed: We have our own “red team” that is always searching our own environment for signs of vulnerability and have a well-defined Cyber Incident Response Plan (“CIRP”) that is performed as a table-top exercise at least annually.
+Added: We have a robust and up-to-date Cyber Incident Response Plan (“CIRP”) that is performed as a table-top exercise at least annually.
A range of dashboards has been designed for use by the cybersecurity management team to monitor the day-to-day performance of the cybersecurity defenses and immediately remediate any sign of concern.
1 unchanged sentence
This assessment scrutinizes the third party’s cybersecurity maturity to ascertain the level of risk the third party may present to the systems and data of GXO and its customers.
+Added: Additionally, these vendors’ security maturity is constantly monitored via a third-party service.
Our Audit Committee and our Board of Directors actively participate in discussions with management and among themselves regarding cybersecurity risks.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.