5 unchanged sentences
The Company has a Chief Information Security Officer (“CISO”) responsible for the evaluation and mitigation of cybersecurity risks in coordination with the Company’s information technology, law, risk and insurance and enterprise risk and compliance groups.
−Removed: These groups work in tandem on cybersecurity and privacy governance, and oversee the Company’s approach to information security, privacy, data governance, and IT infrastructure, which includes internal monitoring to proactively identify potential security threats, maintenance of access controls, asset management, response and recovery activities, and training and awareness programs.
−Removed: The Company maintains technical and organizational safeguards, including vulnerability assessments, endpoint monitoring, penetration testing, employee training, incident response capability reviews and exercises, cybersecurity insurance and business
−Removed: continuity mechanisms to protect the Company’s assets and operations.
+Added: These groups work in tandem on cybersecurity and privacy governance and oversee the Company’s approach to information security, privacy, data governance and IT infrastructure, which includes monitoring to proactively identify potential security threats, maintenance of access controls, asset management, response and recovery activities and training and awareness programs.
+Added: The Company maintains technical and organizational safeguards, including vulnerability assessments, endpoint monitoring, penetration testing, employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms to protect the Company’s assets and operations.
In addition to our internal information security team, we rely on services from various third parties , including a Managed Security Service Provider (“MSSP”) and services from an IT solutions organization.
5 unchanged sentences
Cybersecurity Threats
−Removed: Although we have not experienced a cybersecurity incident that materially affected our results of operations or financial condition, we periodically experience cyberattacks, which may include the use or attempted use of malware, ransomware, computer viruses, phishing, social engineering schemes, and other means of attempted disruption or unauthorized access.
−Removed: Additionally, the rapid pace of change in information security and cybersecurity threats could result in cyberattacks with little or no notice.
+Added: Although we have not experienced a cybersecurity incident that materially affected our results of operations or financial condition, we periodically experience cyberattacks, which may include the use or attempted use of malware, ransomware, computer viruses, phishing, AI-enhanced attacks, deepfake technology, social engineering schemes and other means of attempted disruption or unauthorized access.
+Added: The increasing sophistication of attacks leveraging artificial intelligence and machine learning enables threat actors to automate and scale their operations, create highly convincing phishing campaigns,
+Added: bypass traditional security measures, and adapt their tactics in real-time to evade detection.
+Added: Additionally, the rapid pace of change in information security and cybersecurity threats, including the rapid advancement of AI-driven attack capabilities, could result in cyberattacks with little or no notice.
Our relationships with third parties, including suppliers we manage, customers and vendors to whom we outsource or rely on for business processes or software, creates potential avenues for malicious actors to initiate a supply chain attack.
4 unchanged sentences
Our insurance coverage may not be sufficient to cover all such costs or consequences and there can be no assurance that any insurance that we now maintain will remain available under acceptable terms.
+Added: See Part I, Item 1A.
+Added: Risk Factors under the heading “Risks Related to Cyber Security and Data Privacy” for additional commentary.
Our board of directors oversees consideration of strategic risks to the Company as well as management’s actions to address and mitigate those risks and delegate oversight of specific risk topics to relevant board committees.
6 unchanged sentences
• information on global regulatory changes and best practices.
−Removed: In addition to the reports submitted quarterly by the Company’s Chief Risk and Privacy Officer and CISO, the Vice President of Internal Audit independently assesses the Company’s risk management process and separately reports on the effectiveness of
−Removed: the Company’s risk identification, prioritization, and mitigation processes to the Audit Committee.
+Added: In addition to the reports submitted quarterly by the Company’s Chief Risk and Privacy Officer and CISO, the Vice President of Internal Audit independently assesses the Company’s risk management process and separately reports on the effectiveness of the Company’s risk identification, prioritization and mitigation processes to the Audit Committee.
All board members are kept apprised of its committees’ risk oversight activities through reports from the committee chairs presented at regular Board meetings.
1 unchanged sentence
In line with those procedures, the Company activates an emergency management team (“EMT”), empowered to make decisions and respond to critical events including cyber incident mitigation and remediation activities.
−Removed: EMT members for information security incidents would include the CISO, CIO, and Chief Risk and Privacy Officer, additional member from the information technology and ERM teams as well as representation from the General Counsel Office, Finance, Communications and Business Operations as appropriate.
+Added: Members of the EMT for information security incidents include the CISO, CIO and Chief Risk and Privacy Officer, along with additional representatives from the information technology and ERM teams, as well as the General Counsel Office, Finance, Communications and Business Operations as appropriate.
While active, the EMT provides regular reports to the CEO, General Counsel and other members of the senior leadership team.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.