6 unchanged sentences
In doing so, they administer our Enterprise Risk Management Program that identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company’s and industry’s risk profile using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, conducting scans of potential threat environments, and conducting vulnerability assessments in order to identify vulnerabilities in our systems.
−Removed: We have developed a Cybersecurity Program that allows us to continuously assess and improve the governance, identification, detection, and response of our critical systems;
+Added: We have developed a Cybersecurity Program that is designed to continuously assess and improve the governance, identification, detection, and response of our critical systems;
staying up-to-date with the most innovative technologies.
4 unchanged sentences
Our internal security team, in conjunction with our IT Systems and Cybersecurity Manager works with a third-party risk management company to perform an annual security risk assessment across our organization's systems and processes.
−Removed: This consists of an assessment against the latest National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") 2.0, and its 200+ controls.
+Added: This consists of an assessment against the latest National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”) 2.0, and its more than 200 controls.
There is also a business impact analysis involving all the critical business units, and their systems;
5 unchanged sentences
For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1.
−Removed: Risk Factors in this Annual Report on Form 10-K, including the risk factor titled, “We are increasingly dependent on information technology and our ability to process data in order to operate and sell products, and if we (or our third parties) are unable to protect against software and hardware vulnerabilities, service interruptions, data corruption, cyber-based attacks, ransomware or security breaches, or if we fail to comply with our commitments and assurances regarding the privacy and security of such data, we could experience adverse consequences, including but not limited to regulatory investigations or actions;
+Added: Risk Factors in this Annual Report on Form 10-K, including the risk factor titled, “We are increasingly dependent on information technology and our ability to process data in order to operate and sell products, and if our information technology systems or those third parties with whom we work or our data, are or were compromised, we could experience adverse consequences, including but not limited to regulatory investigations or actions;
fines and penalties;
7 unchanged sentences
The Audit Committee of the board of directors is responsible for reviewing the Company's financial reporting of cybersecurity risks and incidents in accordance with SEC rules.
−Removed: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Technology who has over fifteen years of experience in leading and operating a variety of technology functions including Systems, Infrastructure, Security and Software Engineering and our IT Systems and Cyber Security Manager who has over eight years of experience in designing and implementing secure systems and networks, focused on information and data security.
+Added: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Vice President of Technology who has over twenty years of experience in leading and operating a variety of technology functions and our IT Systems and Cyber Security Manager who has over eight years of experience in designing and implementing secure systems and networks, focused on information and data security.
Our Vice President of Technology and CFO are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, and communicating key priorities to relevant personnel.
2 unchanged sentences
The CFO and Vice President of Technology work with the IT Systems & Cyber Security Manager to help the Company mitigate and remediate cybersecurity incidents of which they are notified.
−Removed: In addition, the Company’s incident response processes include reporting to the board of directors certain cybersecurity incidents.
−Removed: The Audit Committee of the board of directors receives regular reports from the Vice President of Technology concerning the Company’s significant cybersecurity threats and risk and the processes the Company has implemented to address them.
+Added: In addition, the Company’s incident response processes include reporting to the Audit Committee certain cybersecurity incidents.
+Added: The Audit Committee of the board of directors receives annual reports from the Vice President of Technology concerning the Company’s significant cybersecurity threats and risk and the processes the Company has implemented to address them.
The Audit Committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.