5 unchanged sentences
Those activities include briefing the audit committee and the board on information security matters several times a year in their regular meetings and on an ad hoc basis, conducting an annual security training program, and arranging for external security assessments .
−Removed: Together with the audit committee, the board's executive committee assists the board in monitoring management’s risk management framework for cybersecurity on a regular basis.
+Added: Together with the audit committee, the board's executive committee assists the board in monitoring management’s risk management framework for cybersecurity.
IDACORP and Idaho Power include risks from cybersecurity threats, including from use of third-party service providers, as part of the companies' enterprise risk assessment process.
2 unchanged sentences
The companies engage with consultants and other third parties, as necessary, to design, enhance, and implement appropriate cybersecurity measures in seeking to mitigate risks from cybersecurity threats.
−Removed: part of the companies' strategy to manage risks from cybersecurity threats with third-party service providers , the companies seek to include appropriate security clauses in their contracts with those providers, including incident reporting requirements.
+Added: As part of the companies' strategy to manage risks from cybersecurity threats with third-party service providers , the companies seek to include appropriate security clauses in their contracts with those providers, including incident reporting requirements.
A dedicated cybersecurity team lead by a cybersecurity manager and director of security oversee the assessment and management of risks from cybersecurity threats on a day-to-day basis at IDACORP and Idaho Power.
3 unchanged sentences
federal and state agencies, to determine potential risks to the companies' information and control systems.
−Removed: Additionally, the team utilizes a defense-in-depth approach to cybersecurity that provides layers of defenses and monitoring/alerting to which the team responds.
+Added: Additionally, the team utilizes a defense-in-depth approach to cybersecurity that provides layers of defenses and monitoring/alerting to which the
+Added: team responds.
The team also monitors the companies' third-party service providers for risks related to the confidentiality, availability, and integrity of the companies' data and services hosted through those third parties.
The companies have an established cybersecurity incident response plan to provide structure and guidance when responding to cybersecurity incidents.
−Removed: In appropriate cases, an incident response team is activated to lead the companies' response.
+Added: Under the plan, in appropriate cases, an incident response team is activated to lead the companies' response.
The team is composed of individuals from the cybersecurity team and other departments within the companies with relevant expertise, as well as third-party contractors and vendors.
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.