8 unchanged sentences
We rely on our systems and networks to support our business activities.
−Removed: As some of these networks and systems are managed by third parties, the HHH cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with its use of third-party service providers.
+Added: As some networks and systems are managed by third parties, the HHH cybersecurity program also includes evaluation and monitoring of cybersecurity risks associated with its use of third-party service providers.
We also leverage third-party experts and vendors to help manage our cybersecurity program, audit the effectiveness of our existing cybersecurity controls, and make recommendations for improvements and best practices.
1 unchanged sentence
We require all third parties with access to our information systems or data to maintain industry standard cybersecurity programs and to report actual or suspected security incidents to us.
−Removed: We employ a range of tools and strategies to mitigate cybersecurity risks, regularly testing them for effectiveness.
+Added: We employ a range of tools and strategies to mitigate cybersecurity risks and regularly test them for effectiveness.
Additionally, we continuously assess and improve our cybersecurity stance by conducting vulnerability scans, internal and external network penetration tests, and by integrating threat intelligence updates.
1 unchanged sentence
To the extent that our proactive monitoring and testing identifies weakness in our cybersecurity readiness, these weaknesses are tracked and remediated as part of our cybersecurity program.
−Removed: Our employees receive security awareness training on an annual basis and are subjected to phishing training and phishing tests throughout the year.
−Removed: Annually, we perform tabletop exercises to test our cybersecurity incident response plan that is kept within our written information security program (WISP).
+Added: Our employees receive security awareness training at a minimum on an annual basis and are subjected to phishing training and phishing tests throughout the year.
+Added: Annually, we perform tabletop exercises to test our cybersecurity incident response plan.
Our cybersecurity program is aligned with industry standards and best practices such as the National Institute of Standards and Technology Cybersecurity Framework.
As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.
−Removed: However, along with all companies of a similar size, we face common cybersecurity threats.
+Added: However, along with all companies of comparable size, we face common cybersecurity threats.
These threats include ransomware and denial-of-service, including sophisticated attacks from criminal ransomware groups and nation state actors.
2 unchanged sentences
The cybersecurity program is executed by the Company’s Senior Vice President of IT Governance, Risk, and Compliance , who has over 15 years of cybersecurity experience in overseeing and managing cybersecurity risk.
−Removed: He is also responsible for maintaining and, in the event of an actual suspected security incident, executing the Company’s WISP.
−Removed: The Company’s Board of Directors recently formed a technology committee (the Technology Committee) to assume governance and oversight of HHH’s cybersecurity program from the Audit Committee.
+Added: He is also responsible for maintaining and, in the event of an actual or suspected security incident, executing the Company’s incident response plan.
+Added: The Board of Directors’ Technology Committee governs and oversees HHH’s cybersecurity program.
This includes reviewing the cybersecurity program’s strategy and effectiveness, the cybersecurity landscape and emerging threats, and reports from any cybersecurity events.
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.