3 unchanged sentences
Protecting the information maintained by the Company about its patients, customers, colleagues, and partners against external and internal threats is a priority for the Company.
−Removed: Accordingly, the Company invests in the development and implementation of cybersecurity policies, control standards, and control procedures, including a risk management and assessment program, security and event monitoring capabilities, an incident response plan, and other detection, prevention, and protection capabilities, including practices and tools to monitor and mitigate external and insider threats.
−Removed: The Company engages in a risk monitoring process through its Office of Information Security (OIS) within the Information Technology organization that seeks to identify the likelihood and impact of threats to its systems and data, and assesses the effectiveness of the controls in place.
−Removed: The Company has implemented a formal cybersecurity program aligned to the Secure Controls Framework (SCF), a cybersecurity and privacy framework that consolidates and maps controls across multiple regulations, standards, and best practices.
+Added: Accordingly, the Company maintains an enterprise-wide cybersecurity risk management program and invests in cybersecurity policies, control standards, and control procedures, including risk assessment activities, security and event monitoring capabilities, an IR plan, and other detection, prevention, and protection capabilities designed to monitor and mitigate external and insider threats.
+Added: Through its OIS within the Information Technology organization, the Company engages in a risk-based monitoring and assessment process that analyzes potential business impact of cybersecurity threats to its systems and data, and assesses the effectiveness of the controls in place.
+Added: The Company has implemented a formal cybersecurity governance program aligned to elements of the NIST Cybersecurity Framework and the SCF.
+Added: The governance program integrates controls from various regulations, standards, and best practices and supports a structured approach to identifying, protecting against, detecting, responding to, and recovering from cybersecurity threats.
The Company’s program includes the evaluation of the cybersecurity posture of third-party suppliers and vendors that have access to the Company’s data or information technology systems.
−Removed: Consistent with business requirements, components of the Company’s information technology and controls are assessed by independent third parties against various frameworks and standards.
+Added: Consistent with business requirements, components of the Company’s information technology enlivenment and control activities are assessed by independent third parties against various frameworks and standards.
+Added: The Company uses the results of these assessments to inform risk prioritization and remediation planning.
With the assistance of these frameworks and standards, the Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, assesses those systems pursuant to the Company’s cybersecurity policies, control standards, and control procedures, and implements appropriate mitigation measures.
−Removed: Mitigation of identified threats and vulnerabilities may be delayed.
−Removed: The Company has implemented an Incident Response Plan (IR Plan), which is aligned to its overall crisis management program.
−Removed: The IR Plan provides a framework for responding to and managing cybersecurity incidents.
+Added: Incident Response and Resilience
+Added: The Company has implemented an IR Plan, which is integrated with the Company’s enterprise crisis management, business continuity, and disaster recovery programs.
+Added: The IR Plan provides a framework for responding to and managing cybersecurity incidents and is designed to support timely escalation, coordinated decision-making, and effective recovery.
The IR Plan outlines incident response requirements, reporting processes, protocols for incident evaluation, and procedures for notifying and escalating information to the Company’s senior management, and the Board and/or appropriate Board committees, as applicable.
−Removed: The IR Plan is reviewed, tested, and updated under the leadership of the Company’s Chief Information and Technology Officer (CITO) and Chief Information Risk Officer (CIRO).
−Removed: The Company’s cybersecurity team also provides enterprise-wide cybersecurity training for employees to maintain and continuously improve the Company’s mitigation against human-driven risk.
−Removed: Cybersecurity training is conducted annually, in addition to periodic simulations and exercises to test the efficacy of this training, and expanded training is required for specific roles.
+Added: The IR Plan is reviewed, tested, and updated under the leadership of the Company’s CITO and CIRO.
+Added: Employee Training
+Added: The Company’s cybersecurity team provides enterprise-wide cybersecurity training for employees to maintain and continuously improve the Company’s mitigation against human-driven risk.
+Added: Cybersecurity training is conducted annually, with supplemental and role-based training required for personnel with elevated system access or responsibilities.
+Added: The Company also conducts periodic simulations and awareness activities designed to reinforce expected behaviors and reduce the likelihood of cybersecurity incidents.
Engagement with External Cybersecurity Professionals
The Company engages with third parties to assess the effectiveness of, and assist with, its cybersecurity risk and response systems and processes.
−Removed: These third parties include cybersecurity assessors, consultants, and professionals who help identify, verify, and validate cybersecurity risks and support mitigation or incident response plans as needed.
+Added: These third parties include cybersecurity assessors, consultants, and professionals who help identify, verify, and validate cybersecurity risks and support mitigation as appropriate.
Oversight of Third-Party Service Providers
The Company’s processes also are designed to evaluate the cybersecurity threat risks associated with its use of third-party service providers that have applicable levels of access to the Company’s data or information technology systems.
−Removed: The Company performs due diligence on third parties that have access to its systems, data, or facilities that house such systems or data, and it monitors cybersecurity threat risks identified through such due diligence.
+Added: The Company performs due diligence on third parties that have access to its systems, data, or facilities that house such systems or data, and it monitors cybersecurity threats identified through such due diligence.
Cybersecurity Incident Impact
9 unchanged sentences
For additional information about the AMCA Incident, see Note 15 Commitments and Contingencies to the Consolidated Financial Statements “Cybersecurity" and “Risk Factors - Risks Related to Technology and Cybersecurity”.
−Removed: The Company’s board of directors has oversight responsibility for the Company’s enterprise risk management process and it delegates oversight responsibility for certain significant functional areas of risk management to the board’s committees.
−Removed: The Audit Committee of the board of directors is responsible for oversight and review of the Company’s cybersecurity and other information technology risks, controls, and procedures, including the potential impact of such risks on the Company’s business, financial results, operations, and reputation, as well as the Company’s plans to mitigate cybersecurity risks and to respond to cybersecurity incidents.
+Added: The Company’s Board has oversight responsibility for the Company’s enterprise risk management process and it delegates oversight responsibility for certain significant functional areas of risk management to the board’s committees.
+Added: The Audit Committee of the Board is responsible for oversight and review of the Company’s cybersecurity and other information technology risks, controls, and procedures, including the potential impact of such risks on the Company’s business, financial results, operations, and reputation, as well as the Company’s plans to mitigate cybersecurity risks and to respond to cybersecurity incidents.
The CIRO and CITO routinely present cybersecurity reports to the Audit Committee at its regularly scheduled meetings.
9 unchanged sentences
The CIRO has also served on the board of directors of Health-ISAC, an organization of critical infrastructure owners and operators within the health and public health sectors.
−Removed: The CITO and CIRO together lead efforts to design, implement and operate controls deemed appropriate for the management of Company information assets and systems.
−Removed: OIS manages the policies, control procedures, and control standards designed to identify, detect, protect against, respond to, and recover from cybersecurity threats and cybersecurity incidents.
−Removed: This group includes a cybersecurity operations team that is responsible for the information technology security monitoring and incident response activities, the latter covering the response coordination to cybersecurity incidents under the leadership and pursuant to the direction of the CIRO.
−Removed: OIS also oversees the Company’s cybersecurity training program for employees.
+Added: The CITO and CIRO together lead efforts to design, implement, and operate controls deemed appropriate for the management of cybersecurity risks.
+Added: OIS manages the policies, control procedures, and control standards designed to identify, protect against, respond to, and recover from cybersecurity threats and cybersecurity incidents.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.