6 unchanged sentences
This program and its processes are an integral component of our enterprise risk management ("ERM") program.
−Removed: Our cybersecurity program leverages several industry and regulatory frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, International Organization for Standardization Information Security Management Systems ("ISO 27001"), and the Center for Internet Security Critical Security Controls.
+Added: Our cybersecurity program utilizes the International Organization for Standardization Information Security Management Systems (" ISO 27001") framework, which incorporates the National Institute of Standards and Technology and Center for Internet Security frameworks, and various risk management frameworks to proactively evaluate its cybersecurity controls, risks, and overall program effectiveness.
Our approach to protecting our systems uses the concept of defense in depth, providing multiple layers of defense, monitoring, and controls.
−Removed: It is a mutually supporting environment of fit-for-purpose technology, established processes, trained security and operations personnel, and supporting external services.
+Added: It is a mutually supported environment of fit-for-purpose technology, established processes, trained security and operations personnel, and supporting external services.
As of the date of this report, we have not experienced a cybersecurity incident that has materially affected us, including our business strategy, results of operations or financial condition.
While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents.
−Removed: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, but we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect.
+Added: Risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition.
+Added: However, we face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to have such an effect.
Additional information on cybersecurity risks we face can be found in Item 1A “ Risk Factors ” under the heading “Risks Related to Technology, Cybersecurity and Intellectual Property,” which should be read in conjunction with the foregoing information.
Our global security team is led by our Global Vice President Security who reports to the Chief Information Officer.
−Removed: Our Chief Information Officer has more than three decades of technology, security and leadership experience across both the public
−Removed: and private sector.
−Removed: The Global Vice President Security leads the strategy and execution of our cybersecurity program, has more than two decades of dedicated security experience, and holds multiple security qualifications including Certified Information Systems Security Professional ("CISSP").
+Added: Our Chief Information Officer has more than two decades of experience in information technology and process leadership, including leading teams with global cybersecurity responsibilities.
+Added: The Global Vice President Security leads the strategy and execution of our cybersecurity program, has more than two decades of dedicated security experience, and holds multiple security qualifications including Certified Information Systems Security Professional.
He leads an experienced security team, organized and geographically structured with the goal of maximizing responsiveness and coverage for our global enterprise.
11 unchanged sentences
Our systems are further protected via a regular cadence of patching and prioritized vulnerability remediation.
−Removed: Lastly, the use of third-party software in our environment is governed by our third-party risk management (“TPRM”) program, which is designed to assess and remediate cyber and business risks associated with vendor-provided software and services.
+Added: Lastly, the use of third-party software in our environment is governed by our third-party risk management program, which is designed to assess and remediate cyber and business risks associated with vendor-provided software and services.
Integral to our cybersecurity processes is our Security Incident Response Plan ("SIRP"), designed to facilitate the timely and accurate reporting of any material cybersecurity incident.
3 unchanged sentences
Korn Ferry has also maintained cyber insurance for more than a decade.
−Removed: Korn Ferry has been certified by the British Standards Institute (BSI) to ISO/IEC 27001 and ISO/IEC 27018 for our key technology platforms and processes across global operations.
+Added: Korn Ferry has been certified by the British Standards Institute (BSI) to ISO 27001 and ISO/IEC 27018 for our key technology platforms and processes across global operations.
Board of Directors Oversight
11 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.