2 unchanged sentences
Risk Management and Strategy
−Removed: Our cybersecurity program is designed from a risk- and compliance-based approach to achieve systemwide resilience and protection across our operations.
+Added: Our cybersecurity program is designed from a risk- and compliance-based approach to achieve system-wide resilience and protection across our operations.
We regularly assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities.
−Removed: We utilize the National Institute of Standards and Technology Cybersecurity Framework to deliver clear and proactive processes, multi-layered defenses, and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information.
+Added: We model our cybersecurity program after the National Institute of Standards and Technology Cybersecurity Framework to deliver clear and proactive processes, multi-layered defenses, and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information.
Our cybersecurity program includes physical, administrative, and technical safeguards, and we maintain plans and procedures the objective of which is to help us prevent, detect and timely and effectively respond to, and as necessary, recover from, cybersecurity incidents.
Through our cybersecurity risk management program, we have established operational processes to address issues including monitoring and patching of vulnerabilities, regularly updating our information systems, and evaluating new countermeasures made to defend against an evolving landscape of threats.
−Removed: This process is overseen by the Audit Committee of our Board.
+Added: This process is overseen by the Audit Committee of our Board of Directors.
In addition, we periodically engage third-party consultants and providers to assist us in assessing, testing, enhancing and monitoring our cybersecurity risk management programs and responding to any incidents.
1 unchanged sentence
Examples of third-party actions include the engagement of a security operations center for real-time monitoring and response to incidents, independent audits, risk assessments and security certifications.
+Added: We have established processes to help identify and manage cybersecurity risks associated with the use of these third-party consultants and providers, which include the completion of due diligence before engaging with a third-party and assessments and reviews throughout the relationship.
We believe cybersecurity awareness is important in helping prevent cyber threats.
−Removed: To that end, we provide annual cybersecurity awareness training and regular phishing awareness exercises to our tech-enabled employees.
+Added: To that end, we provide monthly cybersecurity awareness training and regular phishing awareness exercises to our tech-enabled employees.
We monitor and assess the success rate of employees reporting phishing scams, and the results inform the development of our security trainings, systems and programs.
Additionally, role-based security training is provided to employees in certain higher-risk positions (including those who handle sensitive information, technology or funds), which is tailored to the heightened cybersecurity risks they face.
−Removed: We have experienced, and may in the future experience, whether directly or through our service providers or other channels, cybersecurity incidents.
+Added: We have experienced, and may in the future experience, whether directly or through our third-party service providers or other channels, cybersecurity incidents.
While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations and reputation .
3 unchanged sentences
Cybersecurity Governance
−Removed: Cybersecurity is an important part of our risk management and strategy activities and an area of focus for our Board and management.
−Removed: Our Audit Committee is responsible for reviewing and monitoring our cybersecurity and information security policies and our internal controls regarding cybersecurity and information security.
+Added: Cybersecurity is an important part of our risk management and strategy activities and an area of focus for our Board of Directors and management.
+Added: Our Board of Directors has delegated to the Audit Committee oversight of our cybersecurity and information security policies and our internal controls regarding cybersecurity and information security.
Our Audit Committee receives regular reports from members of our senior management and other personnel that include assessments and potential mitigation of the risks and exposures to cybersecurity incidents.
1 unchanged sentence
Our Chief Information Officer has over 25 years of experience in information technology and security as well as extensive experience working in and leading our information systems and technology function.
−Removed: The IT Steering Committee and Chief Information Officer receive regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation through the management of, and participation in, the cybersecurity risk management and strategy activities described above, and report to the Audit Committee on any appropriate items.
+Added: The IT Steering Committee and Chief Information Officer receive regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation through the management of, and participation in, the cybersecurity risk management and strategy activities described above, and report to the Audit Committee quarterly on any appropriate items.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.