5 unchanged sentences
Our cybersecurity policies, standards, processes, and practices are integrated across our operational risk management programs and are based on recognized frameworks.
−Removed: A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, our information systems that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.
+Added: A cybersecurity threat is any potential unauthorized occurrence, on or conducted through, our information systems that may result in material adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.
+Added: We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have dedicated resources and implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.
Cybersecurity risk management and strategy
1 unchanged sentence
• Technical Safeguards:
−Removed: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are regularly evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.
+Added: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality,
+Added: Security information and event management, Managed detection and response and access controls, which are regularly evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.
• Incident Response & Recovery Planning:
3 unchanged sentences
We maintain a preemptive and comprehensive risk-based approach to identifying and overseeing potential cybersecurity risks across our entire technology stack.
−Removed: The approach aligns to industry standards such as ISO 27005 (Information Security Risk Management).
+Added: Our cybersecurity program is built upon internationally recognized frameworks, such as ISO 27001, and maps to standards published by The National Institute of Standards and Technology.
This approach also includes third-party risk management issues presented by third parties, including our vendors, service providers and other external users of our systems.
−Removed: We conduct cybersecurity assessments of third-party vendors that we engage with in our operations to identify and evaluate potential vulnerabilities, including on-site visits for evaluation of certain core operational third-party vendors.
+Added: We conduct cybersecurity assessments of third-party vendors that we engage with in our operations to identify and evaluate potential vulnerabilities.
+Added: We also evaluate certain core operational capabilities of our third-party vendors.
In addition, our agreements with material vendors include indemnification provisions with respect to cybersecurity matters.
8 unchanged sentences
In addition, the full Board may review and assess cybersecurity risks as part of its responsibilities for our risk management oversight.
−Removed: In addition, we have an IT Security Committee comprised of our top executives from across the Company, including our Chief Executive Officer, Chief Financial Officer, General Counsel, our Director of Information Security and Privacy.
+Added: In addition, we have an IT Security Committee comprised of our top executives from across the Company, including our Chief Executive Officer, Chief Financial Officer, General Counsel, and our VP of Information Technology and Security.
The IT Security Committee meets quarterly to discuss and address management of the risks facing our business.
Technological risk is a regular component analyzed by our IT Security Committee to identify and assess potential cybersecurity risks across our business operations.
−Removed: Our information security team is led by our Director of Information Security and Privacy, who has decades of experience in information technology and cybersecurity.
−Removed: Furthermore, our Director of Information Security and Privacy holds a number of certifications, including CISSP (Certified Information Systems Security Professional) and CCSP (Certified Cloud Security Professional).
+Added: Our information security team is led by our VP of Information Technology and Security , who has decades of experience in information technology and cybersecurity.
+Added: Furthermore, our VP of Information Technology and Security holds several certifications, including CISSP (Certified Information Systems Security Professional), ACCISO (Associate Certified Chief Information Security Officer) and CISM (Certified Information Security Manager).
The information security team conducts periodic assessment and testing of our policies, standards, processes, and practices that are designed to address a multitude of potential cybersecurity threats and incidents.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.