8 unchanged sentences
The Company has implemented cybersecurity processes, technologies, and controls to aid in its efforts to assess, identify, and manage such risks, including network and endpoint monitoring by a third party managed security services provider and Landstar IT professionals, access controls, vulnerability assessments, penetration testing, regular information security training for employees, and tabletop exercises to inform our IT professionals’ risk identification and assessment.
−Removed: Landstar maintains an Incident Response Plan that guides the actions the Company is to take in the event of a suspected or confirmed cybersecurity incident.
+Added: Landstar maintains an Incident Response Plan that guides the actions
+Added: the Company is to take in the event of a suspected or confirmed cybersecurity incident.
The plan includes processes to triage, investigate, contain, and remediate the incident, and is designed to enable us to comply with applicable legal and regulatory obligations and mitigate financial and reputational damage.
5 unchanged sentences
Members of our IT department collaborate with the Management Risk Committee, as necessary, to gather insights for identifying and assessing cybersecurity threats, their severity, and potential mitigations.
−Removed: Our cybersecurity risk management and strategy processes are led by the Chief Information Officer, who is a member of the Management Risk Committee, and the Vice President of Network Services.
+Added: Our cybersecurity risk management and strategy processes are led by the Chief Information Officer and the Vice President of Network Services, who are each members of the Management Risk Committee
In particular, the Vice President of Network Services leads a team of IT professionals that includes individuals with significant cybersecurity expertise.
1 unchanged sentence
Army involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs.
−Removed: The team of IT professionals led by the Vice President of Network Services includes individuals with relevant degrees and certifications, including Certified Information Security Systems Professional (CISSP), Certified Cyber Security Architect (CCSA), EC-Council Certified Ethical Hacker (CEH), GIAC Certified Forensic Examiner (GCFE), SANS Digital Forensics And Incident Response (FOR408), CompTIA Certified PenTest+, Cisco Certified Network Associate (CCNA), and CompTIA Certified Security+.
+Added: The team of IT professionals led by the Vice President of Network Services includes individuals with relevant degrees and certifications, including Certified Information Security Systems Professional (CISSP), GIAC Foundational Cybersecurity Technologies (GFACT), GIAC Certified Incident Handler Certification (GCIH), GIAC Security Essentials (GSEC), ITIL 4 Foundations, Qualys Certified Specialist - Vulnerability Management Detection & Response, Microsoft Technology Associate:
+Added: Security Fundamentals, Google Cloud Certified:
+Added: Professional Cloud Security Engineer, Cisco Certified CyberOps Associate, Cisco Certified Network Associate (CCNA), CompTIA Security+, and CompTIA Pentest+.
The Company also regularly engages with consultants, auditors, and other third parties, including by having an independent third party Qualified Security Assessor review our cybersecurity program twice each year to help identify areas for continued focus and enhancement.
−Removed: These third parties analyze data on the interactions of users of our information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity controls, systems and processes.
+Added: These third parties analyze data on the interactions of users of our information technology resources, including employees, and conduct penetration tests and vulnerability scanning exercises to assess the performance of our cybersecurity controls, systems and processes.
Our cybersecurity risk management processes also address risks associated with our use of third party service providers, including those who have access to our employee data or our systems that support customers and our network of independent commission sales agents and third party capacity providers.
5 unchanged sentences
However, institutions like us, as well as our employees, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyber attacks.
−Removed: The Company describes whether and how risks from identified cybersecurity threats materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “Disruptions or failures in the Company’s computer systems;
+Added: The Company describes whether and how risks
+Added: from identified cybersecurity threats materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or
+Added: financial condition, under the heading “Disruptions or failures in the Company’s computer systems;
cyber and other information security incidents” included as part of our risk factor disclosure at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.
1 unchanged sentence
The Safety and Risk Committee of the Board is responsible for the oversight of risks from cybersecurity threats.
−Removed: At least semi-annually, the Management Risk Committee and, subsequently, the Safety and Risk Committee of the Board receives an overview of our cybersecurity threat risk management and strategy processes from the Chief Information Officer and the Vice President of Network Services.
+Added: At least semi-annually, the Management Risk Committee and, subsequently, the Safety and Risk Committee of the Board receive an overview of our cybersecurity threat risk management and strategy processes from the Chief Information Officer and the Vice President of Network Services.
These sessions typically cover topics such as data security posture, results from third party assessments, progress towards risk-mitigation-related goals, our incident response plan, cybersecurity vendors and products, and material risks from cybersecurity threats, incidents and developments, as well as the steps management has taken to respond to such risks.
−Removed: Material cybersecurity threat risks are also considered during separate Board and Board committee meeting discussions relating to matters such as enterprise risk management, internal controls over financial reporting and business continuity planning.
+Added: Material cybersecurity threat risks are also considered during separate Board and Board committee meeting discussions relating to matters such as enterprise risk management, IT strategy, internal controls over financial reporting and business continuity planning.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.