3 unchanged sentences
Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of our data, as well as our employee and customer data.
−Removed: The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact.
+Added: The Company has a comprehensive cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact, that is aligned with the National Institute of Standards and Technology (“NIST”).
This program is integrated into the Company’s overall Enterprise Risk Management and Resiliency process.
13 unchanged sentences
While we are regularly subject to cybersecurity attacks, ransomware and other security breaches, the Company has not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2024.
−Removed: The Company does not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition.
+Added: The Company does not believe that there are currently any known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or its business strategy, results of operations or financial condition.
However, as discussed under “ Item 1A.
1 unchanged sentence
Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all cybersecurity attacks, ransomware and other security breaches and we may not be able to implement effective preventive measures against such security breaches in a timely manner.
+Added: The Hershey Company | 2024 Form 10-K | Page 16
Cybersecurity Governance and Oversight
1 unchanged sentence
This oversight is achieved through the Company’s Finance and Risk Management (“F&RM”) Committee, which is comprised of five members of our Board of Directors, and one Board member who serves in an ex-officio capacity.
−Removed: The F&RM Committee is responsible for reviewing key enterprise risks identified through our Enterprise Risk Management and
−Removed: The Hershey Company | 2023 Form 10-K | Page 16
−Removed: Resiliency process, which includes information security strategies and risks, as well as data privacy and protection risks and mitigation strategies (collectively, “Information Security”).
+Added: The F&RM Committee is responsible for reviewing key enterprise risks identified through our Enterprise Risk Management and Resiliency process, which includes information security strategies and risks, as well as data privacy and protection risks and mitigation strategies (collectively, “Information Security”).
At each regularly scheduled F&RM Committee meeting, management, through the Company’s Chief Information Security Officer (“CISO”), reports on Information Security controls, audits, guidelines and developments and the F&RM Committee is notified between such updates regarding significant new cybersecurity threats or incidents.
The CISO, who reports to the Chief Technology Officer (“CTO”), oversees a dedicated Information Security team that is supported by the Privacy Center of Excellence, and works in partnership with internal audit to review certain information technology-related internal controls with our independent auditors as part of the overall internal controls process.
+Added: The Chief Information Officer (“CIO”), who also reports to the CTO, focuses on our technology modernization priorities, integrating innovative technology solutions to support our business goals, and leading enterprise-wide IT transformation initiatives.
Our CTO, who reports to the Chief Executive Officer, has oversight of our Information Security team and leads the company’s global technology strategy, architecting and deploying digital capabilities that are innovative, flexible and prepared to meet the changing needs of our consumers, retail partners and employees.
1 unchanged sentence
The CISO’s Information Security roles have included security engineering, security architecture, strategy development and execution, risk and compliance management and identity and access management and incident response.
+Added: The Company’s CIO has over twenty years of experience, including leading digital transformation and global information technology governance.
The Company’s CTO has over twenty years of experience, including deep expertise in developing cutting-edge automated systems, supply chain planning, optimization and simulation, artificial intelligence and predictive analytics.
2 unchanged sentences
Our Company-wide Information Security training program includes security awareness training, including regular phishing simulations, acceptable use training, cyber wellness trainings and other targeted trainings throughout the year.
+Added: Additional training mechanisms we may use to assess, identify, and manage risks from cybersecurity threats, include simulations, tabletop exercises and response readiness tests to test our preparedness and incident response process.
These trainings provide employees the opportunity to gain an understanding of the various forms of cybersecurity incidents and enable our employees to handle and report any suspicious activity or threat.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.