7 unchanged sentences
From an enterprise perspective, we implement a multi-faceted risk management approach based on the National Institute of Standards and Technology Cybersecurity Framework.
−Removed: We have established policies and procedures that provide
−Removed: the foundation upon which IBM’s infrastructure and data are managed.
+Added: We have established policies and procedures that provide the foundation upon which IBM’s infrastructure and data are managed.
We regularly assess and adjust our technical controls and methods to identify and mitigate emerging cybersecurity risks.
8 unchanged sentences
Risks are assessed and prioritized based, among other things, on the type of offering/engagement, supplier assessments, threat intelligence, and industry practices.
−Removed: As discussed in greater detail in Item 1A., "Risk Factors," the company faces numerous and evolving cybersecurity threats, including risks originating from intentional acts of criminal hackers, hacktivists, nation states and competitors;
+Added: As discussed in greater detail in Item 1A., "Risk Factors," the company faces numerous and evolving cybersecurity threats, including risks originating from the increased use of AI, intentional acts of individual and groups of criminal hackers, hacktivists, state-sponsored organizations, nation states and competitors;
from intentional and unintentional acts or omissions of customers, contractors, business partners, vendors, employees and other third parties;
−Removed: and from errors in processes or technologies, as well as the risks associated with an increase in the number of customers, contractors, business partners, vendors, employees and other third parties working remotely.
+Added: and from errors in processes or technologies, as well as the risks associated with the number of customers, contractors, business partners, vendors, employees and other third parties working remotely.
While the company continues to monitor for, identify, investigate, respond to and remediate cybersecurity risks, including incidents and vulnerabilities, there have not been any that have had a material adverse effect on the company, though there is no assurance that there will not be cybersecurity risks that will have a material adverse effect in the future.
4 unchanged sentences
The CISO also manages the Product Security Incident Response Team (“PSIRT”), which focuses on product vulnerabilities potentially affecting the security of offerings sold to customers.
−Removed: IBM also has Business Information Security Officers (“BISO”) who coordinate with the Office of the CISO on security issues specific to particular business segments.
+Added: IBM also has Business Information Security Officers (“BISO”) who are coordinated by the Office of the CISO on security issues specific to particular business segments.
The CSIRT team, together with the Office of the Chief Information Officer (“CIO”), Cyber Legal, Corporate Security, and BISOs, engages in on-going reviews of incidents, threat intelligence, detections, and vulnerabilities, including to assess client and regulatory impact.
−Removed: Events of interest are promptly reported to the Senior Vice President (“SVP”) for Legal & Regulatory Affairs and General Counsel (“GC”) and the SVP overseeing cybersecurity (“SVP Sponsor”).
+Added: Events of interest are promptly reported to the Senior Vice President (“SVP”) and Chief Legal Officer ("CLO"), and the SVP overseeing cybersecurity (“SVP Sponsor”).
Incidents are delegated to an appropriate incident response team for assessment, investigation, and remediation.
−Removed: Depending on the nature of the matter, the incident response team may include individuals from E&TS, the Office of the CISO, the Office of the CIO, Cyber Legal, Business Units, the Chief Privacy Office, Human Resources, Procurement, Finance and Operations, and Corporate Security.
−Removed: The incident response teams advise and consult with the GC and the SVP Sponsor, as appropriate.
+Added: Depending on the nature of the matter, the incident response team may include individuals from E&TS, the Office of the CISO, the Office of the CIO, Cyber Legal, Business Units, the Office of Privacy and Responsible Technology, Human Resources, Procurement, Finance and Operations, and Corporate Security.
+Added: The incident response teams advise and consult with the CLO and the SVP Sponsor, as appropriate.
The Cybersecurity Advisory Committee (“CAC”) meets regularly and is responsible for overseeing management of the Company’s cybersecurity risk.
−Removed: The CAC is composed of, among others, SVPs from the major business units, the SVP Sponsor, and the GC.
+Added: The CAC is composed of, among others, SVPs from the major business units, the SVP Sponsor, and the CLO.
The CAC is responsible for, among other things, setting the Company’s governance structure for managing cybersecurity risk and reviewing noteworthy cybersecurity incidents and strategies to prevent recurrence.
−Removed: IBM management responsible for managing cybersecurity risk reflects a cross-section of functions from across the organization
−Removed: with significant experience in managing such risk as well as the technologies underlying these risks.
+Added: IBM management responsible for managing cybersecurity risk reflects a cross-section of functions from across the organization with significant experience in managing such risk as well as the technologies underlying these risks.
They also hold leadership positions outside of IBM in the field of cybersecurity, serving on governing and advisory boards of public and private institutions at the forefront of issues related to cybersecurity, including technology development, cybersecurity policy, and national security.
−Removed: The Board of Directors and the Audit Committee oversees the cyber governance process.
+Added: The Board of Directors and the Audit Committee oversee the cyber governance process.
Leadership from E&TS, including the CISO, make regular presentations to the Audit Committee and the full Board on identification, management, and remediation of cybersecurity risks, both internal and external, as well as threat intelligence, emerging global policies and regulations, cybersecurity technologies, and best practices.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.