9 unchanged sentences
We also have a cybersecurity-specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our program to best practices, as well as by engaging experts to attempt to infiltrate our information systems (as such term is defined in Item 106(a) of Regulation S-K).
+Added: We engage third-party partners to conduct two-phase penetration testing simulating external and internal cybersecurity breach situations.
We test and review the result on an annual basis.
+Added: To monitor risk levels, we have engaged a third-party vendor to manage our security operations center (the “SOC”), which provides automatic alerts in response to certain occurrences and triggers automatic rules-based responses.
+Added: Additionally, our annual external Sarbanes-Oxley audit process reviews all account privileges associated with our enterprise resource planning software and other systems supporting the financial function of the Company.
Our cybersecurity program includes controls designed to prevent, identify, protect against, detect, respond to and recover from cybersecurity incidents (as such term is defined in Item 106(a) of Regulation S-K), and to provide for the availability of critical data and systems and to maintain regulatory compliance.
10 unchanged sentences
implement a remote disaster recovery backup site and fail over testing.
−Removed: We perform periodic internal assessments to test our cybersecurity controls and regularly evaluate our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity or personal data breaches, and we perform periodic internal assessments to test our controls and to help us identify areas for continued focus, improvement, and/or compliance.
+Added: We perform periodic internal assessments to test our cybersecurity controls and regularly evaluate our policies and procedures surrounding our handling and control of personal data and the systems we have in place to help protect us from cybersecurity or personal data breaches and to help us identify areas for continued focus, improvement, and/or compliance.
We have established a cybersecurity risk management process that includes internal reporting of significant cybersecurity risk to our board when found.
5 unchanged sentences
We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “ Cybersecurity incidents could disrupt business operations, result in the loss of critical and confidential information and adversely impact our reputation and results of operations ” included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K which disclosures are incorporated by reference herein.
−Removed: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from them were immaterial.
+Added: In the last two fiscal years, we have not experienced any material cybersecurity incidents and have not incurred any material expenses relating to cybersecurity incidents.
This includes penalties and settlements, of which there were none.
1 unchanged sentence
Cybersecurity is an important part of our enterprise risk management program and an area of increasing focus for our Board and management.
−Removed: We have established a Cyber Security Council, comprised of top-level executives and board members, that acts under the oversight of our Audit Committee.
−Removed: The Cyber Security Council is responsible for the oversight of risks from cybersecurity threats.
+Added: In late 2024, we established a Technology Committee of the Board, the purpose of which includes oversight of the Company’s cybersecurity program.
+Added: The Technology Committee consists of three independent directors and is responsible for overseeing the Company’s efforts to monitor cybersecurity risks and management efforts to mitigate such risks.
Management is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of and participation in the cybersecurity risk management process described above, including the operation of our incident response plan.
−Removed: Annually, the Cyber Security Council receives an overview from management of our cybersecurity threat risk management process and strategy covering topics such as data security posture, results from security assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.
−Removed: In such sessions, the Cyber Security Council generally receives materials, including current and emerging material cybersecurity threat risks and describing the company’s ability to mitigate those risks, and discusses such matters with our Vice President of Information Technology.
−Removed: Members of the Cyber Security Council are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management process.
+Added: The Technology Committee receives and reviews reports from management and the Company’s internal audit function concerning cybersecurity incidents, business continuity, data security posture, disaster recovery preparedness, results from security assessments, progress toward pre-determined risk mitigation-related goals, our incident response plan, internal audit results pertaining to technology and cybersecurity controls, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.
+Added: The Technology Committee reports to the full Board on major items covered at meetings of the Technology Committee.
+Added: Members of the Technology Committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management process.
Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.
−Removed: Any potential threat or incident is reported to the Cyber Security Council based on the severity and potential risk based on the escalation procedure as defined by the Incident Response Plan.
+Added: Any potential threat or incident is reported to the Technology Committee based on the severity and potential risk based on the escalation procedure as defined by the Incident Response Plan.
Our cybersecurity risk management process, which is discussed in greater detail above, is led by our Vice President of Information Technology.
This individual has over thirty years of prior work experience in various Information Technology roles including managing information systems and security.
−Removed: Our Vice President of Information Technology and technology professionals have deep experience and skills related to the development, implementation and monitoring of cyber technology assets.
+Added: Our Vice President of Information Technology and technology professionals have deep experience and skills in developing, implementing and monitoring cyber technology assets.
Our technology staff and partners have a strong track record of working with major vendors' security, firewall, identity management, and other platforms.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.