4 unchanged sentences
This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level and that cybersecurity risk remains a key component of management activities, including continuously assessing, identifying, and managing material risks from cybersecurity threats.
−Removed: Our cybersecurity program is based on the U.S.
+Added: Our cybersecurity program is
+Added: based on the U.S.
National Institute for Standards and Technology standards and other applicable country-specific and industry frameworks.
4 unchanged sentences
Systems and process monitoring are essential components of our cybersecurity risk management and information security programs.
−Removed: Management utilizes industry standard tools and procedures to monitor the information security of systems, networks and information assets, regardless of geographic location, and has implemented key policies and procedures, including but not limited to cybersecurity threat detection and analysis, a framework for materiality determination and a reporting-up process to assist in a disclosure of a material event, if required.
+Added: Management utilizes industry standard tools and procedures to monitor the information security of systems, networks and information assets, regardless of geographic location, and has implemented key policies and procedures, including but not limited to cybersecurity threat detection and analysis, a defined framework for materiality determinations and a reporting-up process to support timely disclosure of a material event, if required.
In addition, management has defined key roles and responsibilities within our organization to handle material cybersecurity incidents.
4 unchanged sentences
This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity risk management, strategies and processes remain at the forefront of industry best practices.
−Removed: Because we are aware of the risks associated with third-party service providers, we have implemented processes to oversee and manage these risks, including security assessments of all third-party providers before engagement.
+Added: Because we are aware of the risks associated with third-party service providers, we have implemented processes to oversee and manage these risks, including risk-based security assessments of third-party providers prior to engagement.
In addition, cybersecurity program maturity of such third parties, including incident response and disclosure, is also evaluated.
11 unchanged sentences
The chair of the Audit and Risk Committee, in turn, periodically reports on its review with the Board of Directors, and our COO and CISO report annually to the Board of Directors regarding our cybersecurity program and risk management.
−Removed: Our CISO (who also serves as our Chief Information Officer) leads our information security organization and has primary responsibility for information security strategy, policy, managing our cybersecurity threat detection and response plan, and assessing and managing material risks from cybersecurity threats.
+Added: Our management team is responsible for the day-to-day operations of the cybersecurity program.
+Added: Our CISO (who also serves as our Chief Information Officer) leads our information security organization and has primary responsibility for information security strategy, policy, managing our cybersecurity threat detection and response plan, and assessing and managing material
+Added: risks from cybersecurity threats.
With over 25 years of experience in information security, IT infrastructure and cybersecurity and with several industry certifications such as the Certified Chief Information Security Officer certification, our CISO brings a wealth of expertise to the role.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.