11 unchanged sentences
We draw heavily on our own commercial security solutions and services to manage and mitigate cybersecurity risks.
−Removed: IBM maintains a Security Operations Center (“SOC”) that monitors for threats to IBM’s networks and systems, utilizing threat intelligence provided by a range of sources, including the IBM Security X-Force Exchange platform, which maintains one of the largest compilations of threat intelligence in the world.
+Added: IBM maintains global Security Operations Centers (“SOCs”) that monitor for threats to IBM’s networks and systems, utilizing threat intelligence provided by a range of sources, including the IBM Security X-Force Exchange platform, which maintains one of the largest compilations of threat intelligence in the world.
We also rely on tools licensed from third party security vendors to monitor and manage cybersecurity risks.
8 unchanged sentences
While the company continues to monitor for, identify, investigate, respond to and remediate cybersecurity risks, including incidents and vulnerabilities, there have not been any that have had a material adverse effect on the company, though there is no assurance that there will not be cybersecurity risks that will have a material adverse effect in the future.
−Removed: IBM’s Enterprise & Technology Security (“E&TS”) organization has oversight responsibility for the security of both IBM’s internal systems and external offerings and works across all of the organizations within the company to protect IBM, its brand, and its clients against cybersecurity risks.
−Removed: E&TS also addresses cybersecurity risks associated with third party suppliers.
+Added: Escalation of cyber risk is a core function within IBM's cyber governance so that emerging threats, incidents, and vulnerabilities are promptly communicated, escalated, and remediated at the appropriate leadership level across the enterprise.
+Added: IBM’s Enterprise & Technology Security (“E&TS”) organization is responsible for the security of both IBM’s internal systems and external offerings and works across IBM to protect its brand and its clients against cybersecurity risks.
+Added: also addresses cybersecurity risks associated with third party suppliers.
For these purposes, E&TS includes a dedicated Chief Information Security Officer (“CISO”) whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes for IBM’s internal systems.
−Removed: The CISO manages the CSIRT.
−Removed: The CISO also manages the Product Security Incident Response Team (“PSIRT”), which focuses on product vulnerabilities potentially affecting the security of offerings sold to customers.
−Removed: IBM also has Business Information Security Officers (“BISO”) who are coordinated by the Office of the CISO on security issues specific to particular business segments.
−Removed: The CSIRT team, together with the Office of the Chief Information Officer (“CIO”), Cyber Legal, Corporate Security, and BISOs, engages in on-going reviews of incidents, threat intelligence, detections, and vulnerabilities, including to assess client and regulatory impact.
−Removed: Events of interest are promptly reported to the Senior Vice President (“SVP”) and Chief Legal Officer ("CLO"), and the SVP overseeing cybersecurity (“SVP Sponsor”).
−Removed: Incidents are delegated to an appropriate incident response team for assessment, investigation, and remediation.
−Removed: Depending on the nature of the matter, the incident response team may include individuals from E&TS, the Office of the CISO, the Office of the CIO, Cyber Legal, Business Units, the Office of Privacy and Responsible Technology, Human Resources, Procurement, Finance and Operations, and Corporate Security.
−Removed: The incident response teams advise and consult with the CLO and the SVP Sponsor, as appropriate.
−Removed: The Cybersecurity Advisory Committee (“CAC”) meets regularly and is responsible for overseeing management of the Company’s cybersecurity risk.
−Removed: The CAC is composed of, among others, SVPs from the major business units, the SVP Sponsor, and the CLO.
−Removed: The CAC is responsible for, among other things, setting the Company’s governance structure for managing cybersecurity risk and reviewing noteworthy cybersecurity incidents and strategies to prevent recurrence.
−Removed: IBM management responsible for managing cybersecurity risk reflects a cross-section of functions from across the organization with significant experience in managing such risk as well as the technologies underlying these risks.
+Added: The CISO is responsible for enterprise incident response;
+Added: the Product Security Incident Response Team (“PSIRT”), which focuses on product vulnerabilities potentially affecting the security of offerings sold to customers;
+Added: and the Business Information Security Officers (“BISO”), which focus on security issues specific to particular business segments.
+Added: The CSIRT team, together with the Office of the CISO, Cyber Legal, and BISOs, engage in on-going review of incidents, threat intelligence, detections, and vulnerabilities, including to assess client and regulatory impact.
+Added: CSIRT leads and coordinates incident response investigations and depending on the nature of the matter, may include individuals from E&TS, the Office of the CISO, the Office of the Chief Information Officer, Cyber Legal, Business Units, the Risk, Compliance and Integrity Team, Human Resources, Procurement, Finance and Operations, and Corporate Security.
+Added: Events of interest are promptly reported to the Chief Legal Officer ("CLO"), the Chief Financial Officer, and the Senior Vice President ("SVP") overseeing the impacted business unit.
+Added: If required by the scale of the incident, an executive is appointed to provide the unified business leadership, coordination, and project management necessary to manage the broader business response under the direction of the CLO.
+Added: The Board of Directors, the Audit Committee, and senior management participate in cyber incident tabletops to exercise preparedness for incidents and to strengthen cyber governance.
+Added: The Cybersecurity Advisory Committee (“CAC”) is a senior executive committee comprised of SVPs from the business (Software, Consulting, Infrastructure) and corporate functions (Legal, Finance, Marketing/Communications), which provides oversight and direction for the management of the company's cybersecurity risk.
+Added: It serves as a key resource and escalation point for IBM's CISO and operating units on significant and emerging cybersecurity incidents, risks, policies, and practices.
+Added: IBM executives responsible for managing cybersecurity risk reflect a cross-section of functions from across the organization with significant experience in managing such risk as well as the technologies underlying these risks.
They also hold leadership positions outside of IBM in the field of cybersecurity, serving on governing and advisory boards of public and private institutions at the forefront of issues related to cybersecurity, including technology development, cybersecurity policy, and national security.
−Removed: The Board of Directors and the Audit Committee oversee the cyber governance process.
−Removed: Leadership from E&TS, including the CISO, make regular presentations to the Audit Committee and the full Board on identification, management, and remediation of cybersecurity risks, both internal and external, as well as threat intelligence, emerging global policies and regulations, cybersecurity technologies, and best practices.
−Removed: In addition, senior management provides briefings as needed to the Audit Committee Chair, the Audit Committee, and, as appropriate, the full Board, on cybersecurity issues and incidents of potential interest.
+Added: The Board of Directors and the Audit Committee oversee risk management at IBM.
+Added: Leadership from E&TS, including the CISO, make regular presentations to the Audit Committee and the full Board on identification, management, escalation, and remediation of cybersecurity risks, both internal and external, as well as threat intelligence, emerging global policies and regulations, cybersecurity technologies, and best practices.
+Added: In addition, executive management provides briefings as needed to the Lead Independent Director, Audit Committee Chair, the Audit Committee, and, as appropriate, the full Board on cybersecurity issues and incidents of potential interest.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.