5 unchanged sentences
The Company maintains a risk register to document and track IT risks, including factors such as:
−Removed: Categories (including but not limited to cybersecurity, data privacy, governance, and application development)
+Added: Categories (including but not limited to cybersecurity, data privacy, governance, application development, and AI)
Likelihood and impact
8 unchanged sentences
Cybersecurity Operations and Incident Response Capabilities
−Removed: The Company maintains a Cybersecurity Operations Center (CSOC) comprised of in-house staff, contracted personnel, and other third-party security service providers .
+Added: The Company maintains a Cybersecurity Operations Center (CSOC) comprised of in-house employees, contracted personnel, and other third-party security service providers .
Our CSOC provides constant monitoring, assessment, and defense of all enterprise information systems (including web sites, applications, databases, servers, clients, and data centers) as well as service provider connections and provides incident reporting as needed.
8 unchanged sentences
An initial review for any cybersecurity threat is completed when the provider is onboarded, with subsequent periodic reviews conducted thereafter.
−Removed: These subsequent reviews occur at different intervals, based on the nature of the business relationship, the type of data being exchanged (if any), and the overall potential impact to the Company, and include consideration of factors such as the third party’s cybersecurity capabilities, data protections and privacy measures, and technical capabilities as related to required integrations with the Company’s systems.
+Added: These subsequent reviews occur at different intervals, based on the nature of the business relationship, the type of data being exchanged (if any), and the overall potential impact to the Company, and include consideration of factors such as the third party’s cybersecurity capabilities, data protections and privacy measures, and AI and technical capabilities as related to required integrations with the Company’s systems.
Material Findings from Cybersecurity Risks
2 unchanged sentences
The Board of Directors maintains oversight of risks from cybersecurity-related threats, primarily through the Audit Committee .
−Removed: The Audit Committee holds a separate annual in-person meeting with the Company’s Chief Information Officer (CIO) and subsequently provides an update to the Board.
−Removed: The Company’s CIO also attends a second annual meeting directly with the full Board of Directors.
−Removed: Beginning in 2025, in addition to these annual meetings, the CIO or the Sr.
−Removed: Vice President of Engineering & Technology is scheduled to meet with the Audit Committee such that the Board and the Committee receive updates on at least a quarterly basis.
+Added: The Company’s Chief Information Officer (CIO) meets directly with the full Board of Directors at least annually.
+Added: Three additional times a year the CIO or the Senior Vice President of Engineering and Technology meets with the Audit Committee who subsequently provides an update to the Board, such that the Board and the Committee receive updates on at least a quarterly basis.
Other updates are provided throughout the year to the Audit Committee and the Board, as needed.
10 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.