9 unchanged sentences
The security incident response plan includes processes through which cybersecurity incidents are escalated based on a defined incident risk rating to business stakeholders and a security incident response team, as well as to the Company’s executive officers, which may result in engagement with management’s risk oversight committee (the “ROC”), the Board and the Audit and Risk Committee of the Board (“ARC”) , as needed.
−Removed: To improve preparedness for a cybersecurity
−Removed: incident, we conduct tabletop exercises at least annually.
+Added: To improve preparedness for a cybersecurity incident, we conduct tabletop exercises at least annually.
These exercises are conducted by internal personnel and with assistance from third-party experts, as needed.
Cybersecurity Governance
−Removed: The Program is situated within the Company’s information security department, which is comprised of multiple teams, including security operations, security architecture and engineering, technology governance, mergers and acquisitions information security, and advisor security.
+Added: The Program is situated within the Company’s information security department, which is composed of multiple teams, including security operations, security architecture and engineering, technology governance, mergers and acquisitions information security, and advisor security.
The information security department is led by the chief information security officer, who has primary responsibility for managing the Program.
−Removed: The current chief information security officer has over 20 years of experience in information security, including a lead auditor certification from the International Organization for Standardization, an international standard for information security management systems.
−Removed: The Board has delegated oversight of the Program to the ARC, including oversight of the Company’s cyber- and technology-related risks and the steps management has taken to identify, assess, monitor, and manage those risks.
+Added: The current chief information security officer has over 20 years of experience in information security.
+Added: The Board, which includes a director with cybersecurity expertise, has delegated responsibility for primary oversight of the Program to the ARC, including oversight of the Company’s cyber- and technology-related risks and the steps management has taken to identify, assess, monitor, and manage those risks.
In addition, the Board has established a reporting structure and cadence related to oversight of the Program, which includes respective oversight responsibilities for the Board, the ARC and management risk committees, including the Technology Risk Committee, the Operational Risk Oversight Committee and the Risk Oversight Committee.
−Removed: Each of the Board and the ARC receive staggered periodic reports on the Program’s effectiveness and progress on at least an annual basis.
+Added: Each of the Board and the ARC receive periodic reports on the Program’s effectiveness and progress on at least an annual basis.
The assessment, identification and management of cybersecurity-related risks are integrated into the Company’s overall Enterprise Risk Management (“ERM”) process.
1 unchanged sentence
This risk assessment process is used to inform the Company’s strategic planning process, and to develop action plans to appropriately address and manage risk.
−Removed: It is also used to focus our Board and its committees on the most significant risks to our Company.
+Added: It is also used to focus our Board and its committees on the most significant risks to the Company.
In addition, the enterprise risk function has established foundational frameworks for assessing, monitoring and overseeing the Company’s risks, including risks from cybersecurity threats.
2 unchanged sentences
We engage third-party subject matter experts and consultants to conduct evaluations of our security controls, including, but not limited to, penetration testing, maturity assessments or consulting on our response to emerging threats.
−Removed: Results of these evaluations are used to help determine priorities and initiatives to improve the overall Program.
+Added: Results of these evaluations are used to help determine priorities and initiatives to improve the overall
As necessary, we also engage third-party experts and consultants to assist with the incident response process to augment our internal security operation center team.
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.