UNRESOLVED STAFF COMMENTS
−Removed: Table of C o ntents
CYBERSECURITY
5 unchanged sentences
However, measures that we take to avoid, detect, mitigate or recover from cybersecurity breaches or incidents may be insufficient or become ineffective, and there are no assurances that cybersecurity breaches or incidents will not impact our business operations and strategy, results of operations and financial condition.
−Removed: We maintain a cybersecurity program that includes development and implementation of policies, procedures and tools designed to help ensure availability of critical operations, information technology and telecommunication systems and safeguard sensitive information .
−Removed: The cybersecurity program is assessed against industry standards, including certain Center for Internet Security critical security controls.
+Added: We maintain a cybersecurity program that includes development and implementation of policies, procedures and tools designed to help ensure availability of critical operations, information technology and telecommunication systems and safeguard sensitive informa tion.
+Added: The cybersecurity program is assessed against industry standards, including the National Institute of Standards and Technology Cybersecurity Fram ework.
This assessment is conducted by a third party periodically and internally at least annually.
19 unchanged sentences
The CIO oversees a team dedicated to the support of cybersecurity tools and the overall cybersecurity program.
−Removed: The CIO reports to the Executive Vice President and CFO.
+Added: The CIO reports to the Executive Vice President and Chief Strategy Officer.
The CIO provides periodic briefs regarding prevention, detection, mitigation and remediation of cybersecurity incidents, as well as risks, threats and the threat landscape to the Board and executive management, including the CEO, CFO and CAO.
3 unchanged sentences
Management, including the CIO, provides reports approximately quarterly to the Board regarding risks, threats, the threat landscape, assessments of and improvements to the cybersecurity program, and internal response preparedness.
−Removed: Table of C o ntents
+Added: The Audit Committee provides oversight of policies on risk assessment, controls, and accounting risk exposure, reviews cybersecurity disclosures in filings with the Securities and Exchange Commission, and reviews internal audit reports related to cybersecurity processes.
+Added: The Operations Committee provides focused oversight of operational and capital‑related cybersecurity and technology matters.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.