4 unchanged sentences
We have adopted and maintain a cybersecurity risk management program , as a subset of our broader enterprise risk management program, which is designed in accordance with our risk profile and business.
−Removed: Our cybersecurity risk management program has been informed by industry standards, including the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”).
+Added: Our cybersecurity practices are aligned with standard industry frameworks such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, International Organization for Standardization (ISO) 27001, Center for Internet Security Critical Security Controls and other industry standards.
Our cybersecurity risk management program incorporates multiple components, including, but not limited to, policies, guidelines, procedures, infrastructure, and systems that are designed to protect the confidentiality, integrity and availability of our critical systems and information.
14 unchanged sentences
Our Board of Directors (the “Board”) has delegated responsibility for enterprise risk management, including cybersecurity risk oversight, to our Audit Committee (the “Committee”) .
−Removed: The Committee receives quarterly information security updates from our Chief Financial Officer and Vice President of Information Technology ( “ VP of IT ” ).
+Added: The Committee receives quarterly information security updates from our Chief Financial Officer and Senior Director of Governance & Information Security (the “Senior Director, GIS”).
The Committee in turn reports to the full Board regarding its activities, including those related to cybersecurity, on at least a bi-annual basis.
−Removed: The VP of IT has twenty seven years of experience in information technology, fifteen of which have involved IT leadership for various organizations.
−Removed: Our Director, IT Governance and Security (the “Director, IT”) reports to our VP of IT and is responsible for the day-to-day management of our cybersecurity risk management program.
−Removed: The Director, IT has eighteen years of experience in information technology.
−Removed: The Director, IT receives support from our operational team which comprises cybersecurity, IT, controllership, and legal professionals who regularly review cybersecurity matters and evaluate emerging threats, as well as act as first responders to triage any cybersecurity incidents.
+Added: The Senior Director, GIS , who has been a head of information security for close to 15 years and has more than 27 years of overall experience in IT and cyber security industry, holds a Bachelor of Science in Information Technology from Bina Nusantara University and Master of Business Administration from University of Liverpool.
+Added: He receives support from our operational team which comprises cybersecurity, IT, controllership, and legal professionals who regularly review cybersecurity matters and evaluate emerging threats, as well as act as first responders to triage any cybersecurity incidents.
In the event of a cybersecurity incident, the Committee and Board receive updates from this team on an ad-hoc basis, if appropriate, under our tiered escalation support framework.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.