7 unchanged sentences
The Company employs a multi-faceted cybersecurity risk management framework, which is integrated into its enterprise risk management system.
−Removed: The Company aligns its security policies and practices with the ISO 27001 framework and manages its cybersecurity risks through a dedicated information security team, reporting to the Head of Information Security.
+Added: The Company’s security policies and practices follows the ISO 27001 framework and manages its cybersecurity risks through a dedicated information security team, reporting to the Vice President, Information Security.
The information security team is tasked with, among other things, assessing, identifying and managing material cybersecurity risks and overseeing the implementation of the Company’s cybersecurity strategy.
3 unchanged sentences
Risk Mitigation Measures
−Removed: The information security team implements and maintains a multi-layered defense approach to safeguard the Company’s information technology infrastructure in accordance with industry best practices and updates the Company’s systems and software to address identified vulnerabilities.
+Added: The information security team implements and maintains a multi-layered defense approach designed to safeguard the Company’s information technology infrastructure in accordance with industry practices and updates the Company’s systems and software to address identified vulnerabilities.
The Company has also developed an incident response and disaster recovery plan to respond to cybersecurity incidents.
Vendor Risk Management
−Removed: The Company evaluates the risk profile of its third-party service providers and may include cybersecurity enhancement or compliance requirements in its service agreements, as needed.
+Added: The Company evaluates the risk profile of its third-party service providers as needed and may include cybersecurity enhancement or compliance requirements in its service agreements, as needed.
The information security team periodically reviews key vendors and counterparties’ cybersecurity practices and may conduct audits or assessments at its discretion.
3 unchanged sentences
ROLE OF THE BOARD OF DIRECTORS
−Removed: The Audit Committee oversees the Company’s risk management and assessment, including its mitigation strategies, and updates the entire Board on the Company’s risk profile and exposures on an as needed basis.
−Removed: With respect to cybersecurity, the Company’s Chief Technology Officer (“CTO”) and Head of Information Security updates the Audit Committee on at least an annual basis on matters such as external cybersecurity threats and attack trends;
+Added: The Audit Committee oversees the Company’s risk management and assessment, including its mitigation strategies, and updates the Board on the Company’s risk profile and exposures on an as needed basis.
+Added: With respect to cybersecurity, the Company’s Chief Technology Officer (“CTO”) and Vice President, Information Security update the Audit Committee on at least an annual basis on matters such as external cybersecurity threats and attack trends;
updates to threat monitoring processes;
2 unchanged sentences
cybersecurity strategy;
−Removed: cybersecurity metrics, and assessments
−Removed: the progress of cybersecurity programs;
+Added: cybersecurity metrics, and assessments of the progress on cybersecurity programs;
and the potential scope and impact of cybersecurity risks and incidents on the Company’s operations and financial condition.
3 unchanged sentences
Management presents the Company’s risk assessment, which includes its cybersecurity risks, to the Audit Committee on at least an annual basis.
−Removed: The CTO leads management’s assessment and management of cybersecurity risks.
−Removed: The Company’s Head of Information Security leads the information security team, which is responsible for managing day-to-day cybersecurity risks and implementing and maintaining the Company’s cybersecurity strategy.
−Removed: The Head of Information Security reports to and regularly briefs the CTO on cybersecurity matters, including results of vulnerability testing and remediation, cyber incident responses, and progress on cybersecurity infrastructure initiatives.
−Removed: The CTO and Head of Information Security update the Audit Committee about cybersecurity risks and any investigation of a material cybersecurity incident.
+Added: The CTO leads management’s assessment and management of cybersecurity risks, including to monitor for the prevention, detection, mitigation, and remediation of cybersecurity incidents.
+Added: The Company’s Vice President, Information Security leads the information security team, which is responsible for managing day-to-day cybersecurity risks and implementing and maintaining the Company’s cybersecurity strategy.
+Added: The Vice President, Information Security reports to and regularly briefs the CTO on cybersecurity matters, including results of vulnerability testing and remediation, cyber incident responses, and progress on cybersecurity infrastructure initiatives.
+Added: The CTO and Vice President, Information Security update the Audit Committee about cybersecurity risks and any investigation of a material cybersecurity incident.
The Company’s current CTO has over 25 years of experience in senior technology leadership roles, involving oversight of all aspects of technology development and technical operations, including cybersecurity.
−Removed: The Company’s current Head of Information Security has over 20 years of experience in cybersecurity roles, including in cybersecurity engineering, information security assessment, and development and management of corporate security policies and governance problems.
+Added: The Company’s current Vice President, Information Security has over 20 years of experience in cybersecurity roles, including in cybersecurity engineering, information security assessment, and development and management of corporate security policies and governance problems.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.