6 unchanged sentences
Through our ERM process, we have identified cybersecurity as among the material risks in our business.
−Removed: One way we manage cybersecurity risks is through our Global Information Security and Compliance ("GISC") program.
+Added: We manage cybersecurity risks through our Global Information Security and Compliance ("GISC") program.
The GISC program is designed to protect the confidentiality, integrity and availability of our information systems and data.
10 unchanged sentences
In addition to the cybersecurity incident response plan, individual functions and Hertz locations maintain business continuity plans that identify critical business services, establish recovery objectives and create methods for implementing such plans in the event of business interruption due to a cybersecurity incident or other event.
−Removed: One of the business continuity plans in place at the Company is a plan applicable to our data centers.
Given the dynamic nature of the cybersecurity threat environment, we engage third-party assessors, consultants and others from time to time to assist us with assessing, enhancing, implementing and monitoring our cybersecurity risk-management programs.
−Removed: We review the results of the assessments from these third parties and determine whether to adjust our cybersecurity policies and processes based thereon.
+Added: We review the results of the assessments from these third parties and use these results, among other things, to determine whether to adjust our cybersecurity policies and processes.
We also have a privacy and data security program, which covers the collection, transfer, storage and use of customer data.
We take steps to prevent and detect cybersecurity threats in an effort to protect our information and systems, and in turn, to protect our customers’ privacy.
−Removed: Additionally, we have taken steps to address material risks from cybersecurity threats at third parties, including service providers, licensees and franchisees, that handle, possess, process and store our material information.
+Added: Additionally, we have taken steps to address risks from cybersecurity threats at third parties, including service providers, licensees and franchisees, that handle, possess, process and store our significant business information.
We require these third parties to maintain certain security controls and assess these third parties' compliance with such requirements.
18 unchanged sentences
While our Board and Audit Committee oversee risk, our senior leadership is responsible for identifying, assessing and managing our exposure to risk, including material risks from cybersecurity threats.
−Removed: Direct accountability of our cybersecurity program is housed within our Information Technology organization, which is led by our Chief Information Officer ("CIO").
−Removed: Our CIO has served in this role since October 2021.
−Removed: Our CIO has 12 years of experience in senior technology roles with cybersecurity responsibilities.
−Removed: Prior to joining the Company, our CIO held various executive technology and operations positions, as well as various IT, consulting and commercial roles.
−Removed: Our CIO holds an Executive MBA and a Bachelor of Commerce degree.
−Removed: Our Chief Information Security Officer ("CISO") is the individual that reports to our CIO and provides day-to-day oversight of our cybersecurity program;
+Added: Direct accountability of our cybersecurity program is housed within our Information Technology organization, which is led by our Chief Information Technology Officer ("CITO").
+Added: Our CITO has more than 30 years of global leadership experience across technology, digital transformation, operations and customer experience.
+Added: Prior to joining the Company, our CITO was the Chief Operating and Information Officer at The Container Store, and has also previously held various other executive technology and customer positions.
+Added: Our CITO holds an MBA;
+Added: in addition, he holds a Bachelor of Engineering in Electronics and Telecommunication degree.
+Added: Our Chief Information Security Officer ("CISO") is the individual that reports to our CITO and provides day-to-day oversight of our cybersecurity program;
our CISO additionally leads our cybersecurity program's ongoing evolution.
2 unchanged sentences
The team consists of individuals that represent various organizations and departments across the Company who have knowledge, skills and expertise to respond to a cybersecurity incident.
−Removed: Our CISO coordinates with the Company’s disclosure teams relating to potentially material cybersecurity incidents, attends the Company’s disclosure committee meetings, and regularly discusses with the Audit Committee the effectiveness of the Company’s technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks.
+Added: Our CISO coordinates with the Company’s disclosure teams relating to cybersecurity incidents, attends the Company’s disclosure committee meetings, and regularly discusses with the Audit Committee the effectiveness of the Company’s technology security, capabilities for disaster recovery, data protection, cyber threat detection and cyber incident response and management of technology-related compliance risks.
Our CISO has served in this role since March 2024.
12 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.