6 unchanged sentences
ISG performs annual assessments, by two independent third parties, against the International Organization Standardization (“ISO”) 27001 Information Security Management System requirements for which we maintain certification.
−Removed: ISG also maintains certification across other cyber security frameworks, including the Trusted Information Security Assessment Exchange and UK Cyber Essentials, and is preparing for SOC2 attestation across our GovernX platforms .
+Added: ISG also maintains certification across other cyber security frameworks, including the Trusted Information Security Assessment Exchange and UK Cyber Essentials.
+Added: In 2024, the Company achieved a System and Organization Controls 2 (“SOC2”) Type 1 against our GovernX platforms, and we are preparing to continue maturity in this area by seeking to attain SOC2 Type 2 in 2025.
The Company’s cybersecurity efforts are led by the Chief Information Security Officer (“ CISO ”) , who reports to the Chief Information Officer (“CIO”) and has responsibilities that cover the management of cybersecurity risk and the protection and defense of our networks and systems .
1 unchanged sentence
Our CISO also holds relevant cyber management qualifications, such as being a Certified Information Systems Security Professional.
−Removed: The CISO manages a team of qualified cybersecurity professionals with broad experience and expertise across cyber security disciplines that provide ad-hoc reports to the CISO regarding cybersecurity threats and incidents.
+Added: The CISO manages a team of qualified cybersecurity professionals with broad experience and expertise across cybersecurity disciplines that provide ad-hoc reports to the CISO regarding cybersecurity threats and incidents.
Cybersecurity risk is maintained and managed under our Information Security Management System framework with oversight through our internal Executive Board (“IEB”) and our Board of Directors, which has delegated responsibility for cybersecurity risk to our Information Security Committee (“ISC”) .
3 unchanged sentences
In addition, the IEB makes decisions on resourcing and project prioritization in support of our cybersecurity and compliance initiatives .
−Removed: Responsibility for cybersecurity risk has been delegated to the ISC, which consists of senior executives (including three IEB members), namely the Chief Financial Officer (IEB member), Chief Human Resources Officer (IEB member), Chief Information Officer, Chief Data and Analytics Officer (IEB member), Chief Information Security Officer, Legal Counsel, Director of Corporate Governance and Data Privacy Manager.
+Added: Responsibility for cybersecurity risk has been delegated to the ISC, which consists of senior executives (including three IEB members), namely our Chief Financial Officer (IEB member), Chief Human Resources Officer (IEB member), Chief Information Officer, Chief Data and Analytics Officer (IEB member), Chief Information Security Officer, Legal Counsel, Director of Corporate Governance and Data Privacy Manager.
The ISC oversees the management of processes for identifying and mitigating cybersecurity risks, material vulnerabilities and high-rated incidents to help align our risk exposure with our strategic objectives.
5 unchanged sentences
We also share and receive threat intelligence which we utilize to bolster defenses against active threats.
−Removed: These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, clients, employees, vendors, intellectual property and drive continuous improvement across the security domain.
−Removed: ISG recognizes that if our third-party suppliers are affected by cyber security incidents, we could be indirectly impacted, including, the potential loss of service (which could be a significant component of our services to clients), exposure of ISG or client data or a potential backdoor into ISG systems or network.
+Added: These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, clients, employees, vendors, intellectual property and drive continuous improvement across our security domain.
+Added: ISG recognizes that if our third-party suppliers are affected by cyber security incidents, we could be indirectly impacted, including, through the potential loss of service (which could be a significant component of our services to clients), exposure of ISG or client data or a potential backdoor into ISG systems or network.
We maintain processes and procedures to continuously assess third-party cybersecurity risk and include security and privacy addendums to our contracts where applicable.
10 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.