5 unchanged sentences
The Company engages in a risk monitoring process through its Office of Information Security (OIS) within the Information Technology organization that seeks to identify the likelihood and impact of threats to its systems and data, and assesses the effectiveness of the controls in place.
+Added: The Company has implemented a formal cybersecurity program aligned to the Secure Controls Framework (SCF), a cybersecurity and privacy framework that consolidates and maps controls across multiple regulations, standards, and best practices.
+Added: The Company’s program includes the evaluation of the cybersecurity posture of third-party suppliers and vendors that have access to the Company’s data or information technology systems.
Consistent with business requirements, components of the Company’s information technology and controls are assessed by independent third parties against various frameworks and standards.
−Removed: With the assistance of these frameworks and standards, the Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and assesses those systems pursuant to the Company’s cybersecurity policies, control standards, and control procedures.
+Added: With the assistance of these frameworks and standards, the Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, assesses those systems pursuant to the Company’s cybersecurity policies, control standards, and control procedures, and implements appropriate mitigation measures.
Mitigation of identified threats and vulnerabilities may be delayed.
1 unchanged sentence
The IR Plan provides a framework for responding to and managing cybersecurity incidents.
−Removed: The IR Plan identifies applicable requirements for incident response, outlines processes for any applicable reporting, as well as provides protocols for incident evaluation, processes for notification and internal escalation of information to the Company’s senior management, and the Board and/or appropriate Board committees, as applicable.
+Added: The IR Plan outlines incident response requirements, reporting processes, protocols for incident evaluation, and procedures for notifying and escalating information to the Company’s senior management, and the Board and/or appropriate Board committees, as applicable.
The IR Plan is reviewed, tested, and updated under the leadership of the Company’s Chief Information and Technology Officer (CITO) and Chief Information Risk Officer (CIRO).
The Company’s cybersecurity team also provides enterprise-wide cybersecurity training for employees to maintain and continuously improve the Company’s mitigation against human-driven risk.
+Added: Cybersecurity training is conducted annually, in addition to periodic simulations and exercises to test the efficacy of this training, and expanded training is required for specific roles.
Engagement with External Cybersecurity Professionals
The Company engages with third parties to assess the effectiveness of, and assist with, its cybersecurity risk and response systems and processes.
−Removed: These third parties include cybersecurity assessors, consultants, and other cybersecurity professionals who assist in the identification, verification, and validation of cybersecurity risks, as well as support associated mitigation or incident response plans when necessary.
+Added: These third parties include cybersecurity assessors, consultants, and professionals who help identify, verify, and validate cybersecurity risks and support mitigation or incident response plans as needed.
Oversight of Third-Party Service Providers
2 unchanged sentences
Cybersecurity Incident Impact
−Removed: The Company describes whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect it, including its business and operating results, financial condition, and impact on the Company’s reputation and customer relationships, under the Summary of Material Risks section of this Annual Report, and under the “Risks Related to Technology and Cybersecurity” heading and subheadings thereunder in Part I, Item 1A.
+Added: The Company describes whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect it, including its business and operating results, financial condition, and impact on the Company’s reputation and customer relationships under the “Risks Related to Technology and Cybersecurity” heading and subheadings thereunder in Part I, Item 1A.
“Risk Factors” of this Annual Report, which disclosures are incorporated by reference herein.
15 unchanged sentences
The CITO has more than 15 years of experience working in information technology-related roles and is a member of the Company’s executive leadership team and reports to the Chief Executive Officer.
−Removed: Prior to joining the Company, the CITO held various chief information officer roles with global companies.
+Added: Prior to joining the Company, the CITO held various leadership positions with global companies.
The CIRO, under the direction of the CITO, is responsible for overseeing the OIS.
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.