8 unchanged sentences
Cybersecurity is a critical part of our enterprise risk management.
−Removed: To address cybersecurity threats, we leverage a multi-layer approach, with our Audit Committee providing oversight and direction and our Chief Information Officer (“CIO”) leading a team that is responsible for forming our enterprise-wide information security strategy, training, policy, standards, architecture and processes to protect us against cybersecurity risks.
+Added: To address cybersecurity threats, we leverage a multi-layer approach, with our Audit Committee providing oversight and direction and our Chief Legal and Administrative Officer leading a team that is responsible for forming our enterprise-wide information security strategy, training, policy, standards, architecture and processes to protect us against cybersecurity risks.
Our program includes protocols for preventing, detecting, and responding to cybersecurity incidents, and cross-functional coordination and governance of business continuity and disaster recovery plans.
17 unchanged sentences
At each of their respective meetings, the Board and/or Audit Committee receive, and provide feedback on, reports on relevant data protection and cybersecurity matters.
−Removed: Additionally, two regular Board meetings each year and each Audit Committee meeting include additional, in-depth technology and cybersecurity briefings from senior members of our information technology department, internal audit function, and legal department.
+Added: Additionally, at two meetings each year, management includes additional, in-depth technology and cybersecurity briefings from senior members of our information technology department, internal audit function, and legal department.
The topics covered by these reports and briefings include risk management strategies, data protection, ongoing risk mitigation activities, cybersecurity strategy, governance structure, and the results of security breach simulations.
Management’s Role
−Removed: Our cybersecurity risk management program is led by our Chief Information Officer (“CIO”), who reports to our CEO and manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents.
−Removed: The CIO meets regularly with the CEO and his direct reports to discuss cybersecurity risk and ensure appropriate resources are prioritized to address risks.
+Added: Our cybersecurity risk management program is led by our Chief Legal and Administrative Officer (CL&AO), who reports to our CEO and manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents.
+Added: The CL&AO meets regularly with the CEO and his direct reports to discuss cybersecurity risk and ensure appropriate resources are prioritized to address risks.
We continue to secure our own manufacturing and information technology infrastructure;
2 unchanged sentences
We periodically (more than annually) perform tabletop exercises to test our incident response procedures, identify gaps and improvement opportunities and exercise team preparedness.
−Removed: The Company’s Chief Information Officer has formal education in information technology and extensive experience over 20 years working in and leading information systems and technology functions.
−Removed: Our Chief Information Officer receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation.
−Removed: The Company’s team responsible for developing and executing our cybersecurity policies together with our CIO, including our Director of Cybersecurity and Director of IT Infrastructure and Operations, are individuals with formal education and degrees in information technology or cybersecurity, experience working in information technology and cybersecurity, including relevant industry experience in security related industries, or a combination of both education and experience.
+Added: The Company’s CL&AO has formal education in information technology and computer science, and extensive experience over 30 years leading information systems and network security functions, centered on technology-intensive telecommunication companies and electronics manufacturers.
+Added: Our CL&AO receives regular updates on cybersecurity matters, results of mitigation efforts, and cybersecurity incident response and remediation.
+Added: The Company’s team responsible for developing and executing our cybersecurity policies together with our CL&AO, including our Director of Cybersecurity and Director of IT Infrastructure and Operations, are individuals with formal education and degrees in information technology or cybersecurity, experience working in information technology and cybersecurity, including relevant industry experience in security related industries, or a combination of both education and experience.
Additionally, leaders in the Company’s information technology function receive periodic training and education on cybersecurity-related topics.
−Removed: The CIO is responsible for providing quarterly updates to the Board's Audit Committee regarding the effectiveness of the Company's cybersecurity program and any material cybersecurity incidents that may arise.
+Added: The CL&AO is responsible for providing quarterly updates to the Board’s Audit Committee regarding the effectiveness of the Company’s cybersecurity program and any material cybersecurity incidents that may arise.
The Company’s Kimball Electronics Support Center (“KESC”) serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target employees or our information systems and incidents originating from third parties.
1 unchanged sentence
The KESC escalates incidents with significant impact and pervasiveness to the Company’s Cybersecurity Incident Response Team (“CIRT”) for further action.
−Removed: Depending on the nature of the attack or indicator, our MSSP will collaborate with us in response to incidents to contain, mitigate, respond to, investigate and eliminate threats.
+Added: Depending on the nature of the attack or indicator, our MSSP will collaborate with our KESC, CIRT, and senior members of our information technology department in response to incidents to contain, mitigate, respond to, investigate and eliminate threats.
Where appropriate, the CIRT will escalate incidents to the Audit Committee and the Board for additional consideration, action, and potential disclosure.
1 unchanged sentence
These teams are also responsible for activating containment and resolution efforts and interfacing with third-party service providers like our MSSP where appropriate to support the Company through the resolution of the incident.
−Removed: After initial identification, the KESC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness and communicates with our leaders, including the CIO and CIRT about the same.
+Added: After initial identification, the KESC monitors all cybersecurity incidents for changes in degree of impact or pervasiveness and communicates with our leaders, including the CL&AO and CIRT about the same.
Risks from Cybersecurity Threats
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.