1 unchanged sentence
Cybersecurity
−Removed: Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure
−Removed: The Company assesses, identifies, and manages cybersecurity risk using a data-driven risk management program intended to reduce risks to the following impact classes:
−Removed: the Company’s obligations to prevent harm to parties, including employees, customers, and stockholders;
−Removed: and the Company’s business objectives .
+Added: Cybersecurity Risk Management and Strategy
+Added: We assess, identify, and manage cybersecurity risk using a data-driven risk management program intended to maintain our Company’s obligations to prevent harm to parties, including employees, customers, and stockholders;
+Added: as well as reduce cybersecurity risks associated with our Company’s pursuit of business objectives .
As part of our cybersecurity strategy, we set risk targets based on our risk thresholds using industry-recognized standards for controlling and evaluating the risk of cybersecurity threats.
The Company has developed cybersecurity policies supported by defined standards, including identity and access control, network controls, operational security, information classification, cybersecurity risk management, incident management and reporting, and security in software development lifecycle.
−Removed: We undertake scheduled and targeted cybersecurity risk assessments to identify and prioritize risks to our three impact classes so that foreseeably harmed parties (which include our employees, contractors, partners, customers, stockholders, consumers, and suppliers) are explicitly included in our risk analysis and risk management priorities.
+Added: We undertake scheduled and targeted cybersecurity risk assessments to identify and prioritize risks so that foreseeably harmed parties (which include our employees, contractors, partners, customers, stockholders, consumers, and suppliers) are explicitly included in our risk analysis and risk management priorities.
We plan for, implement, and improve safeguards that are designed to reduce unacceptable risks to any foreseeably harmed party.
−Removed: We engage third-party service
−Removed: providers (including contractors and vendors) as part of our normal business operations, including collaborating with third-party experts to assist with evaluating, identifying, and managing our cybersecurity risks.
+Added: We engage third-party service providers (including contractors and vendors) as part of our normal business operations, including collaborating with third-party experts to assist with evaluating, identifying, and managing our cybersecurity risks.
Our cybersecurity risk management program includes:
−Removed: • Ongoing audits of third-party service providers, including penetration testing and reviews of program maturity based on the National Institute of Standards and Technology (“NIST”) cybersecurity framework;
+Added: • Penetration testing of the Kraft Heinz environment, and annual review of program maturity based on National Institute of Standards and Technology (“NIST”);
• Due diligence reviews of third-party service providers’ information security programs;
18 unchanged sentences
Risk management reports describe cybersecurity priorities, planned safeguards, and resource requirements necessary to achieve acceptable risk outcomes for foreseeably harmed parties.
+Added: Cybersecurity Governance
The Company governs cybersecurity risk through a risk management program designed to enable employees, members of the Audit Committee, Enterprise Risk Committee, executive officers, and other personnel to make informed decisions about cybersecurity risk management that are appropriate for their level of responsibility.
5 unchanged sentences
Our Security Operations Center verifies and validates the threat information and modifies our detection and preventative controls as appropriate.
−Removed: Our CISO works closely with our Chief Global Ethics and Compliance Officer and Global General Counsel and Corporate Affairs Officer to oversee compliance with legal, regulatory,
−Removed: and contractual security requirements.
+Added: Our CISO works closely with our Chief Global Ethics and Compliance Officer and Global General Counsel and Corporate Affairs Officer to oversee compliance with legal, regulatory, and contractual security requirements.
The CISO’s team evaluates third-party service providers to a degree commensurate with the risk their services pose to us.
As part of that program, we also provide feedback to service providers about risks they can reduce using commercially available safeguards.
−Removed: Additionally, the information security team works in partnership with the Company’s internal audit team to review information technology-related internal controls as part of our overall internal controls process.
+Added: Additionally, the information security team works in partnership with the Company’s internal audit and internal controls teams to review information technology-related internal controls as part of our overall internal audit and controls processes.
The Audit Committee is responsible for oversight of the Company’s information technology and cybersecurity risks.
1 unchanged sentence
The Audit Committee regularly reports to the Board on information technology, cybersecurity, and privacy matters.
+Added: Additionally, the Board receives updates from our Global Chief Information Officer and CISO at least annually on information security, cybersecurity, and privacy matters.
We have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Audit Committee or Board, with ongoing updates regarding any such incident until it has been addressed.
1 unchanged sentence
Despite ongoing efforts to improve our and third parties’ ability to protect against cybersecurity threats, we may not be able to protect all information systems, products, and service technologies.
+Added: Cybersecurity Incident Disclosure
While we have not experienced any material cybersecurity threats or incidents as of the date of this Annual Report on Form 10-K, there can be no guarantee that we will not be the subject of future successful attacks, threats, or incidents that may materially affect the Company or its business strategy, results of operations or financial condition.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.