4 unchanged sentences
Significant time and resources are devoted to the protection of the Company’s systems and data, including the staffing of an experienced internal cybersecurity team, the use of a variety of preventative, detective and recovery tools, and engagement with external service providers to bolster the Company’s cyber defense and response capabilities.
−Removed: Our Chief Information Officer (CIO) has over 30 years of information technology and cybersecurity experience and our Chief Information Security Officer (CISO) has more than 15 years of direct cybersecurity experience.
+Added: Our Chief Information Officer (CIO) has more than 30 years of information technology and cybersecurity experience and our Chief Information Security Officer (CISO) has more than 15 years of direct cybersecurity experience.
In addition, the Company’s Internal Audit team includes members with information technology and cybersecurity expertise and training.
3 unchanged sentences
The Company’s Board of Directors provides oversight of the Company’s cybersecurity risks through its Audit Committee.
−Removed: Four of the eight members of the Board of Directors, and three of the four Audit Committee members, possess skills related to information technology and cybersecurity.
+Added: Three of the eight members of the Board of Directors, all Audit Committee members, possess skills related to information technology and cybersecurity.
The Audit Committee reviews the Internal Audit team’s cyber-related control audits to confirm that cyber risks are being appropriately managed and also reviews a periodic report produced by the CIO and CISO on the performance of the Company’s cybersecurity program.
7 unchanged sentences
A variety of controls exist to minimize the impact of these risks and ensure each is managed within organizational tolerances, which controls are monitored by management for effectiveness.
−Removed: In addition, James River's Information Security Office conducts cybersecurity risk reviews on new and existing third-party vendors and business partners, which are presented to management so that either appropriate risk mitigation controls can be established with respect to such third-party or the Company can avoid engaging with such third-party if they are deemed to present an unacceptable level of risk.
+Added: In addition, James River's Information Security Office conducts cybersecurity risk reviews on new and existing third-party vendors and business partners, which are presented to management so that either appropriate risk mitigation controls can be established with respect to such
+Added: third-party or the Company can avoid engaging with such third-party if they are deemed to present an unacceptable level of risk.
Independent cybersecurity testing is performed by outside parties on at least an annual basis to identify opportunities for cyber control strengthening in the face of applicable threats.
2 unchanged sentences
The Information Security Office conducts company-wide cybersecurity training, including through an annually required course of online training modules and a continuous email phishing test campaign.
−Removed: In addition, the CISO leads an annual cybersecurity tabletop exercise with company leadership to continually improve the organization’s preparedness for cyber incidents.
+Added: In addition, the CISO leads periodic cybersecurity tabletop exercises with company leadership to continually improve the organization’s preparedness for cyber incidents.
These exercises consider real-world events that could impact the business and seek to fine-tune response activities in an effort to minimize future cybersecurity incident impacts.
−Removed: Risk Factors - " We rely on our systems and employees, and those of certain third-party vendors and service providers in conducting our operations, and certain failures, including internal or external fraud, operational errors, systems malfunctions, or cyber-security incidents, could materially adversely affect our operations" for additional discussion.
+Added: Risk Factors — General Risk Factors " We rely on our systems and employees, and those of certain third-party vendors and service providers in conducting our operations, and certain failures, including internal or external fraud, operational errors, systems malfunctions, or cyber-security incidents, could materially adversely affect our operations" for additional discussion.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.