1 unchanged sentence
CYBERSECURITY
+Added: The Company’s cybersecurity risk management processes are a component of the Company’s overall risk management program.
The Company’s Board of Directors, directly and through its committees , is responsible for overseeing cybersecurity risks that affect the Company.
3 unchanged sentences
The ARC is informed of such risks through regular reviews with management regarding any specific cybersecurity issues that could affect the adequacy of internal controls over financial reporting.
−Removed: The Company’s cybersecurity risk management processes are a component of the Company’s overall risk management program.
−Removed: The Company's Cybersecurity Committee (the “CSC”) oversees the establishment and operations of cybersecurity risk management processes and strategies and directs activities to identify and detect cybersecurity threats, protect the Company’s assets and to respond and recover from cybersecurity incidents.
−Removed: The CSC is responsible for coordination with the Company’s internal audit, risk management and/or crisis management teams to review and respond to cybersecurity threats.
−Removed: The CSC is chaired by a member of the Office of the Chief Information Security Officer (“Office of the CISO”) and includes members of senior management from operations, finance and legal.
−Removed: The CSC is expected to meet quarterly.
−Removed: In coordination with the Office of the CISO, the CSC reviews and reports on the Company’s cybersecurity activities to the ARC on a quarterly basis and to the full Board of Directors on at least an annual basis.
−Removed: The CSC works with the Company’s Office of the CISO, which is responsible for the daily direction of cybersecurity risk activities.
+Added: The Company’s Office of the Chief Information Security Officer (“Office of the CISO”), which is responsible for the daily direction and management of cybersecurity risk activities, consists of the Chief Information Security Officer, Chief Information and Digital Officer and other information technology and cybersecurity specialists.
The Office of the CISO uses various data protection frameworks and conducts vulnerability assessments, cybersecurity monitoring and recovery software, employee, supplier and dealer training programs and monitoring of incidents and threats.
Members of the Office of the CISO also engage with the Company’s internal audit department to review cybersecurity threats focusing on operational applications and databases through the course of their activities.
−Removed: The Office of the CISO consists of the Director of Cybersecurity, the Chief Information Officer and other information technology and cybersecurity specialists.
−Removed: The Office of the CISO has extensive experience in information technology including roles in cybersecurity, privacy, software engineering, systems engineering, infrastructure and data center management.
+Added: The Chief Information Security Officer has extensive experience in information technology including roles in cybersecurity, privacy, software engineering, systems engineering, infrastructure and data center management, and is a Certified Information Security Manager and a Certified Data Privacy Solutions Engineer.
+Added: The Company's Office of the CISO chairs the Company’s Cybersecurity Committee (the “CSC”), which oversees the establishment and operations of cybersecurity risk management processes and strategies and directs activities to identify, detect, assess and manage risks from cybersecurity threats, protect the Company’s assets and to respond and recover from cybersecurity incidents.
+Added: The CSC is responsible for coordination with the Company’s internal audit, risk management and/or crisis management teams to review and respond to cybersecurity threats.
+Added: The CSC includes members of senior management
+Added: from operations, finance and legal.
+Added: The CSC is expected to meet quarterly.
+Added: On behalf of the CSC, the Office of the CISO review and reports on the Company’s cybersecurity activities to the ARC on a quarterly basis and to the full Board of Directors on at least an annual basis.
In addition, the Company engages third parties to assist in assessing, enhancing, implementing and monitoring the Company's cybersecurity risk-management programs.
The Company maintains processes to oversee and identify risks from cybersecurity threats associated with its use of third-party service providers.
−Removed: The Company has experienced cybersecurity threats and vulnerabilities in its information systems and those of third-party providers.
−Removed: Such prior events have not had a material impact on the Company’s financial condition, results of operations or liquidity.
−Removed: If, in the future, the Company’s or a third-party provider’s information systems suffer severe damage, disruption, breach, or shutdown, and business continuity plans do not effectively resolve the issues in a timely manner, then the Company could be subject to litigation with third parties, government enforcement actions, penalties, disruption to operations and product systems, unauthorized release of confidential or otherwise protected information, corruption of data or remediation costs, which could materially adversely affect the Company’s operating results, financial position or reputation.
−Removed: See “Risks Related to Cybersecurity” in “Risk Factors” beginning on page 11 of this Annual Report on Form 10-K.
+Added: The Company has experienced cybersecurity threats, cybersecurity incidents and vulnerabilities in its information systems and those of third-party business partners.
+Added: As of the date of this filing, the Company has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have had or are reasonably likely to have a material impact on the Company’s business strategy, results of operations or financial condition.
+Added: If, in the future, the Company’s or a third party's information systems suffer severe damage, disruption, breach, or shutdown, and business continuity plans do not effectively resolve the issues in a timely manner, then the Company could be subject to litigation including individual claims or consumer class actions, commercial litigation, administrative, civil or criminal investigations or actions, regulatory intervention, government enforcement actions, penalties, sanctions or fines, disruption to operations and product systems, unauthorized release of confidential or otherwise protected information, corruption or alteration of data, payment of ransom, or investigation and remediation costs, which could result in a negative impact on the Company’s business strategy, results of operations, financial condition or reputation.
+Added: See "Risks Related to Cybersecurity" in Part I, Item 1A.
+Added: Risk Factors, in this Annual Report on Form 10-K.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.