4 unchanged sentences
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.
−Removed: We design and assess our program using components of the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").
+Added: We design and assess our program using
+Added: components of the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").
This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
−Removed: Our cybersecurity risk management program is led by our senior vice president of information technology who has over 20 years of experience in information technology development and capabilities.
−Removed: Our cybersecurity risk management program includes the following
−Removed: key components, which allows the management team to stay informed about and monitor the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents:
+Added: Our cybersecurity risk management program is led by our senior vice president of information technology who has over 25 years of information technology experience that includes application development, information technology infrastructure, security, business continuity, and engineering.
+Added: He holds a master's degree in computer science and a bachelor of engineering in electrical engineering.
+Added: Our vice president of cybersecurity reports to the senior vice president of information technology and has over 25 years of operations and security experience backed by an undergraduate degree in computer management and various technology and security certifications.
+Added: Our vice president of cybersecurity is responsible for the day-to-day assessment and management of cybersecurity risk.
+Added: Our cybersecurity risk management program includes the following key components, which allows the management team to stay informed about and monitor the prevention, detection, mitigation and remediation of key cybersecurity risks and incidents:
• implementing technologies to proactively monitor vulnerabilities and reduce risk, maintaining security policies and standards, and regularly updating our response planning and protocols;
9 unchanged sentences
While we have not been materially affected by known cybersecurity threats affecting the Company, we and our hotel managers continue to face risks from cybersecurity threats that, if realized, could materially adversely affect us in the future.
−Removed: For more information on the risks related to cybersecurity threats, including threats faced by our hotel managers, see Part 1 Item 1A.
−Removed: "Risk Factors — Cyber threats and the risk of data breaches or disruptions of our managers’ or our own information technology systems, or the information technology systems of third parties on which we or our managers rely, could materially adversely affect our business and results .”
+Added: For more information on the risks related to cybersecurity threats, including threats faced by our hotel managers, see Part I, Item 1A.
+Added: "Risk Factors — We face the risk of material data breaches and disruptions of our managers’ or our own information technology systems, or the information technology systems of third parties on which we or our managers rely, which could materially adversely affect our business and results .”
Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.
1 unchanged sentence
The Audit Committee receives semi-annual updates on topics related to information security and cyber risks and readiness from our management team, including our senior vice president of information technology.
−Removed: Management updates the Audit Committee, as necessary, regarding any significant cybersecurity incidents.
+Added: Management updates the Audit Committee, as necessary, regarding any
+Added: significant cybersecurity incidents.
The Audit Committee reports to the full Board regarding its activities, including information security and cybersecurity risks, which are presented to the full Board at least annually as part of the Board's oversight of enterprise risk management.
−Removed: See Part 1 Item 1.
+Added: See Part I, Item 1.
“Business—Our Consolidated Hotel Portfolio” above for a discussion of our hotels.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.