6 unchanged sentences
The Company’s cybersecurity policies, standards, and procedures apply to all users, creating awareness of threats and the importance of information security and cybersecurity across the Company’s workforce.
−Removed: The policies and standards were created using elements of recognized standards such as ISO 27001 and the NIST Cybersecurity Framework for the overall enterprise and ISA/IEC 62443 for automation and control system products.
+Added: These policies and standards are reviewed annually to reflect emerging threats and evolving industry practices, including elements of recognized standards such as ISO 27001 and the NIST Cybersecurity Framework for the overall enterprise and ISA/IEC 62443 for automation and control system products.
The Company has implemented cybersecurity policies throughout its operations, including designing and incorporating cybersecurity into the development process for its products and services.
8 unchanged sentences
The Company also maintains a cybersecurity insurance policy.
−Removed: The Company engages with third parties to perform security assessments of its technology environment to perform penetration testing and maturity assessment as well as providing services to support threat analysis and incident detection and response.
+Added: The Company engages with third parties to perform security assessments of its technology environment, including penetration testing and maturity assessments, in addition to providing services to support threat analysis and incident detection and response.
Cybersecurity considerations affect the selection and oversight of the Company’s third-party product and service providers .
2 unchanged sentences
Such undertakings may include requirements to comply with administrative, technical and physical safeguards to provide notification of cyber incidents involving the Company’s systems or data and agreements to be subject to cybersecurity audits, which the Company conducts as appropriate .
−Removed: The Company requires compliance with appropriate certifications (e.g., SOC 2, ISO 27001, etc.) depending on the offering, region of use, and other factors.
−Removed: During the weekend of September 23, 2023, the Company experienced a cybersecurity incident impacting its internal IT infrastructure and applications.
−Removed: The incident caused disruptions and limitation of access to portions of the Company's business applications supporting aspects of the Company's operations and corporate functions.
−Removed: The impact of the incident included lost and deferred revenues, primarily attributable to order processing and logistics disruptions and delays, and expenses associated with the response to, and remediation of, the incident.
−Removed: Further, the cybersecurity incident caused disruptions to certain of the Company’s billing systems, which negatively impacted cash provided from continuing operations primarily during the first quarter of fiscal 2024.
−Removed: The overall impact of the cybersecurity incident did not have a material impact on net income, net of insurance recoveries, or cash flows from operations for the full year fiscal 2024.
+Added: The Company requires compliance with appropriate certifications (e.g., SOC 2, ISO 27001, etc.) or appropriate alternative requirements, depending on the offering, region of use, and other factors.
+Added: The Company's results of operations, and financial condition were adversely affected by its previously disclosed September 2023 cybersecurity incident due to lost and deferred revenues, remediation expenses and billing and cash collection.
+Added: However, the overall impact of the cybersecurity incident did not have a material impact on net income, net of insurance recoveries, or
+Added: cash flows from operations for fiscal year 2024.
+Added: The Company is regularly subject to cybersecurity threats.
+Added: See “Risk Factors” in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats.
Cybersecurity Governance
The Company’s Board of Directors (the "Board”) has oversight of the management of the most significant risks facing the Company, including cybersecurity.
−Removed: The Board receives information technology and cybersecurity updates from senior management, including the Chief Information Officer, Chief Information Security Officer (“CISO”) and Chief Technology Officer, several times per year.
−Removed: These updates cover the cybersecurity risks facing the Company’s enterprise information
−Removed: technology environment, as well as the Company’s digital products and services.
+Added: The Board receives information technology and cybersecurity updates from senior management, including the Chief Digital and Information Officer ("CDIO") and Chief Information Security Officer (“CISO”) several times per year.
+Added: These updates cover the cybersecurity risks facing the Company’s enterprise information technology environment, as well as the Company’s digital products and services.
Regular oversight of cybersecurity matters is further delegated by the Board to the Governance and Sustainability Committee.
−Removed: The Governance and Sustainability Committee provides a deeper level of oversight through quarterly engagements with senior management, including the Chief Information Officer and CISO, to review the Company’s cybersecurity program, including the highest risk areas and key mitigation strategies.
+Added: The Governance and Sustainability Committee provides a deeper level of oversight through quarterly engagements with senior management, including the Chief Digital and Information Officer and CISO, to review the Company’s cybersecurity program, including the highest risk areas and key mitigation strategies.
The Company maintains a Cybersecurity Steering Committee ("CSC") designed to ensure effective governance of risks associated with the Company’s use of information and technology assets and demonstrate effective governance of cybersecurity risk.
−Removed: The CSC is chaired by the CISO, and includes the Company’s Chief Financial Officer, General Counsel, Chief Information Officer, and other senior representatives from the Company’s business segments and functions.
+Added: The CSC is chaired by the CISO, and includes the Company’s Chief Financial Officer, General Counsel, CDIO, and other senior representatives from the Company’s business segments and functions.
The CSC meets quarterly to monitor the current risk landscape and active risk reduction efforts.
Through this review and monitoring activity, the CSC oversees effective governance of IT Risk Management in the Enterprise IT Portfolio, drives accountability and transparency of control effectiveness, and facilitates risk remediation and mitigation in a coordinated and comprehensive manner.
−Removed: The CISO is appointed by the Chief Information Officer and is responsible for cybersecurity risk management across the Company.
+Added: The CISO has been appointed by the Chief Digital and Information Officer and is responsible for cybersecurity risk management across the Company.
The CISO leads a global enterprise security team responsible for enterprise-wide security strategy, architecture, engineering, and operations.
−Removed: The Cybersecurity Steering Committee has granted authority to the CISO to pause or stop business processes during the execution of cybersecurity incident response duties if they deem it necessary.
+Added: The CSC has granted authority to the CISO to pause or stop business processes during the execution of cybersecurity incident response duties if they deem it necessary.
The CSC maintains approval authority for the Company’s Enterprise Information Security Policy.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.