6 unchanged sentences
These groups work in tandem on cybersecurity and privacy governance, and oversee the Company’s approach to information security, privacy, data governance, and IT infrastructure, which includes internal monitoring to proactively identify potential security threats, maintenance of access controls, asset management, response and recovery activities, and training and awareness programs.
−Removed: The Company maintains technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms to protect the Company’s assets and operations.
+Added: The Company maintains technical and organizational safeguards, including vulnerability assessments, endpoint monitoring, penetration testing, employee training, incident response capability reviews and exercises, cybersecurity insurance and business
+Added: continuity mechanisms to protect the Company’s assets and operations.
In addition to our internal information security team, we rely on services from various third parties , including a Managed Security Service Provider ("MSSP") and services from an IT solutions organization.
−Removed: To evaluate the effectiveness of these internal and external efforts, Kelly adopted the National Institute of Standards and Technology Cybersecurity framework (NIST CFS) and is assessed against NIST CFS by a third-party firm at least annually.
+Added: To evaluate the effectiveness of these internal and external efforts, Kelly adopted the National Institute of Standards and Technology Cybersecurity framework ("NIST CSF") and is assessed against the NIST CSF by a third-party firm at least annually.
We use the assessment, reviews and exercises to ensure that the Company’s information security program and processes for managing material cybersecurity risks are responsive to changes in the threat environment.
1 unchanged sentence
We actively review the risks associated with all third-party service providers at the inception of our relationship with them and on an ongoing basis as part of our information security program and enterprise risk management third-party risk assessment process.
−Removed: These processes include architecture reviews and contractual clauses related to data protection and compliance, SSAE audits and reviews of vendor SOC 1 and SOC 2 Type II reports for critical vendors and ongoing monitoring and reporting of vendor security by independent third parties.
+Added: These processes include architecture reviews and contractual clauses related to data protection and compliance, SSAE audits and reviews of vendor System and Organization Controls ("SOC") 1 and SOC 2 Type II reports for critical vendors and ongoing monitoring and reporting of vendor security by independent third parties.
Cybersecurity Threats
7 unchanged sentences
Our insurance coverage may not be sufficient to cover all such costs or consequences, and there can be no assurance that any insurance that we now maintain will remain available under acceptable terms.
−Removed: Our Board of Directors oversees consideration of strategic risks to the Company as well as managements actions to address and mitigate those risks and delegate oversight of specific risk topics to relevant board committees.
−Removed: The Company’s CISO, Chief Enterprise Risk and Privacy Officer, and Audit Committee Chair of the Company’s Board of Directors review the Company’s cybersecurity metrics on access controls, asset management, response and recovery activities, training and awareness programs, cybersecurity threats and certain incident information quarterly, and on an ad hoc basis when necessary, with each committee chair and other directors (including the CEO) of the Company’s Board of Directors, the Company’s chief people officer, chief financial officer and general counsel.
−Removed: The Chief Enterprise Risk and Privacy Officer holds similar quarterly reviews with the Company’s CEO and executive officers.
+Added: Our board of directors oversees consideration of strategic risks to the Company as well as management’s actions to address and mitigate those risks and delegate oversight of specific risk topics to relevant board committees.
+Added: The Company’s CISO, Chief Information Officer ("CIO"), Chief Risk and Privacy Officer, General Counsel, Chief Financial Officer ("CFO"), Chief Executive Officer ("CEO"), and other officers review the Company’s cybersecurity metrics on access controls, asset management, response and recovery activities, training and awareness programs, cybersecurity threats and certain incident information quarterly, and on an ad hoc basis when necessary.
+Added: The Company's Chief Risk and Privacy Officer, CISO, Vice President of Internal Audit and certain members of this management team and select members from their teams convene monthly to manage cybersecurity and privacy governance.
+Added: The Chief Risk and Privacy Officer holds similar quarterly reviews with the Audit Committee Chair of the Company's Board of Directors, each committee chair, and other directors including the CEO, CFO, and General Counsel.
During these reviews, topics include:
2 unchanged sentences
• information on global regulatory changes and best practices.
−Removed: In addition to the reports submitted quarterly by the Company’s Chief Risk Officer and CISO, the Vice President of Internal Audit independently assesses the Company’s risk management process and separately reports on the effectiveness of the Company’s risk identification, prioritization, and mitigation processes to the Audit Committee.
+Added: In addition to the reports submitted quarterly by the Company’s Chief Risk and Privacy Officer and CISO, the Vice President of Internal Audit independently assesses the Company’s risk management process and separately reports on the effectiveness of
+Added: the Company’s risk identification, prioritization, and mitigation processes to the Audit Committee.
All board members are kept apprised of its committees’ risk oversight activities through reports from the committee chairs presented at regular Board meetings.
1 unchanged sentence
In line with those procedures, the Company activates an emergency management team ("EMT"), empowered to make decisions, and respond to critical events including cyber incident mitigation and remediation activities.
−Removed: EMT members for information security incidents would include the CISO, the CIO, and Chief Enterprise Risk and Privacy Officer, additional member from the information technology and ERM teams as well as representation from the General Counsel Office, Finance,
−Removed: Communications and Business Operations as appropriate.
+Added: EMT members for information security incidents would include the CISO, CIO, and Chief Risk and Privacy Officer, additional member from the information technology and ERM teams as well as representation from the General Counsel Office, Finance, Communications and Business Operations as appropriate.
While active, the EMT provides regular reports to the CEO, General Counsel and other members of the senior leadership team.
The Company’s Chief Information Security Officer is responsible for the assessment and management of material risks related to cybersecurity.
−Removed: The CISO reports directly to the Chief Information Officer (CIO) and has served in the CISO role since its creation in 2021 and in similar roles with the Company since 2011.
−Removed: The CISO has more than 30 years of experience in the information technology field, including more than 20 years of experience helping secure organizations in the professional services, manufacturing and US Intelligence/Department of Defense sectors.
−Removed: He holds a BS in Business/Information Systems.
+Added: Our CISO has over 20 years of experience in information security and security engineering at various technology and staffing companies.
+Added: The CISO reports directly to the CIO, who has over 30 years of experience serving as Chief Information Officer, Director of IT, and other roles in corporate information technology at staffing and technology companies.
In addition, the Company’s Management Team and Cybersecurity and Privacy Governance Team is composed of individuals with collective decades of experience in information technology, data protection, threat response, emergency management, business continuity, and disaster recovery.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.