3 unchanged sentences
Innospec has strategically integrated cyber security risk management into its broader risk management framework to promote a company-wide culture of cyber security risk management.
−Removed: This integration ensures that cyber security considerations are an integral part of our decision-making processes at every level.
+Added: This integration ensures that cyber security considerations are an integral part of our decision-making processes at every
For example, training on cyber security risks was required of all Innospec directors and employees who have access to our information technology resources.
3 unchanged sentences
IT leadership will, when required by either executive management or the Board, engage third-party reviews of our overall cyber security compliance using The National Institute of Technology (“NIST”) framework.
−Removed: IT leadership will also periodically engage specialist security contractors to test the
−Removed: Company’s resilience to cyber security threats, conduct penetration testing and vulnerability assessments across its assets and request additional investment where necessary to further improve our cyber security.
+Added: IT leadership will also periodically engage specialist security contractors to test the Company’s resilience to cyber security threats, conduct penetration testing and vulnerability assessments across its assets and request additional investment where necessary to further improve our cyber security.
Innospec utilizes an external service to provide ongoing analysis of the security related to our critical third-party service providers for IT operations and business IT services.
7 unchanged sentences
NCC reports its findings directly to the Board.
−Removed: In addition, in early 2020 the Audit Committee retained Deloitte to lead a series of information technology risk evaluations.
−Removed: The evaluation resulted in a three-year audit plan covering Cyber Security, Legacy IT and IT Strategy.
−Removed: The audit plan was approved by the Audit Committee.
Innospec’s Board has delegated responsibility for the management of the Company’s IT to the Company's IT steering committee via the CEO and CFO .
2 unchanged sentences
The IT steering committee may, as per its agreed terms of reference, escalate any matter it wishes to the Board via either the CEO or CFO.
−Removed: IT leadership is made up of senior managers with the appropriate qualifications and business experience required for their roles across Innospec’s IT operations.
−Removed: The Company considers that the IT leadership team is sufficiently experienced and qualified in its role of assessing and managing cyber security risks across the business.
−Removed: IT leadership formally reports through the CEO and CFO to the Board.
+Added: IT leadership is made up of senior managers with the appropriate qualifications and business experience required for their roles overseeing Innospec’s IT operations.
+Added: In addition, the IT leadership team includes specialists with many years cyber security experience at both Innospec and previously with other organizations, combined with multiple cyber security qualifications.
+Added: Innospec's IT leadership formally reports through the CEO and CFO to the Board.
Innospec’s CEO and CFO are involved with and approve the Company’s strategy for managing the prevention, detection, mitigation and remediation of cyber security incidents as part of its “IT Security Management System” which includes defined escalation and internal communications processes and responsibilities.
2 unchanged sentences
Any cyber security incident that is considered significant in nature will be shared by IT leadership with the IT steering committee in accordance with the agreed communication and escalation processes.
−Removed: The IT steering
−Removed: committee will assess the incident and make a recommendation to the CEO and CFO as to whether the incident is reportable to the SEC and/or other regulators or stakeholders.
+Added: The IT steering committee will assess the incident and make a recommendation to the CEO and CFO as to whether the incident is reportable to the SEC and/or other regulators or stakeholders.
In the last three fiscal years, management has determined there were no cyber security threats that have materially affected Innospec and that the expenses incurred relating to cyber incidents have been immaterial.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.