8 unchanged sentences
The Company has implemented cybersecurity processes, technologies, and controls to aid in its efforts to assess, identify, and manage such risks, including network and endpoint monitoring by a third party managed security services provider and Landstar IT professionals, access controls, vulnerability assessments, penetration testing, regular information security training for employees, and tabletop exercises to inform our IT professionals’ risk identification and assessment.
−Removed: Landstar maintains an Incident Response Plan that guides the actions
−Removed: the Company is to take in the event of a suspected or confirmed cybersecurity incident.
+Added: Landstar maintains an Incident Response Plan that guides the actions the Company is to take in the event of a suspected or confirmed cybersecurity incident.
The plan includes processes to triage, investigate, contain, and remediate the incident, and is designed to enable us to comply with applicable legal and regulatory obligations and mitigate financial and reputational damage.
1 unchanged sentence
Our cybersecurity risk management processes incorporate appropriate industry standards and are designed using the frameworks developed by National Institute of Standards and Technology (“NIST”) as a guide.
−Removed: Our enterprise risk management program reports at least quarterly to the Management Risk Committee and considers cybersecurity threat risks alongside other types of risks as part of our overall risk assessment process.
−Removed: The Management Risk Committee consists of those members of executive management of the Company with ultimate responsibility for the Company’s enterprise risk management practices.
+Added: The Company has established a Management Risk Committee .
+Added: The Management Risk Committee meets at least quarterly and considers cybersecurity threat risks alongside other types of risks as part of the Company’s risk assessment and management process.
Members of the Management Risk Committee regularly engage in discussions and meetings relating to cybersecurity risk management and strategy processes and the prevention, detection, mitigation and remediation of cybersecurity incidents.
Members of our IT department collaborate with the Management Risk Committee, as necessary, to gather insights for identifying and assessing cybersecurity threats, their severity, and potential mitigations.
−Removed: Our cybersecurity risk management and strategy processes are led by the Chief Information Officer and the Vice President of Network Services, who are each members of the Management Risk Committee
−Removed: In particular, the Vice President of Network Services leads a team of IT professionals that includes individuals with significant cybersecurity expertise.
−Removed: The Vice President of Network Services has over 27 years of experience in various roles with the Company as well as with the U.S.
−Removed: Army involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs.
−Removed: The team of IT professionals led by the Vice President of Network Services includes individuals with relevant degrees and certifications, including Certified Information Security Systems Professional (CISSP), GIAC Foundational Cybersecurity Technologies (GFACT), GIAC Certified Incident Handler Certification (GCIH), GIAC Security Essentials (GSEC), ITIL 4 Foundations, Qualys Certified Specialist - Vulnerability Management Detection & Response, Microsoft Technology Associate:
+Added: Our cybersecurity risk management and strategy processes are led by the Chief Information Officer and the Chief Information Security Officer, who are each members of the Management Risk Committee.
+Added: The Company has also established an Executive Risk Committee that meets monthly and focuses on enterprise risk management.
+Added: The Executive Risk Committee is comprised of the Chief Executive Officer, the Chief Financial Officer, the Chief Safety and Operations Officer and the General Counsel.
+Added: The Chief Information Officer and the Chief Information Security Officer regularly meet with the Executive Risk Committee to review and consider cybersecurity-related risks from an enterprise risk management perspective.
+Added: The Chief Information Security Officer leads a team of IT professionals that includes individuals with significant cybersecurity expertise.
+Added: The Chief Information Security Officer has over 30 years of experience in cybersecurity and information technology across multiple publicly traded organizations, with the responsibility for leading and managing cybersecurity, developing cybersecurity strategy, and designing and implementing effective cybersecurity programs.
+Added: Prior to joining the Company in June 2025, the Chief Information Security Officer served as Chief Information Security Officer of LL Flooring.
+Added: The team of IT professionals led by the Chief Information Security Officer includes individuals with relevant academic credentials and industry-recognized certifications, including Certified Information Security Systems Professional (CISSP), GIAC Foundational Cybersecurity Technologies (GFACT), GIAC Certified Incident Handler Certification (GCIH), GIAC Security Essentials (GSEC), ITIL 4 Foundations, Qualys Certified Specialist—Vulnerability Management Detection & Response, Microsoft Technology Associate:
Security Fundamentals, Google Cloud Certified:
9 unchanged sentences
However, institutions like us, as well as our employees, service providers and other third parties, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of increasingly sophisticated cyber attacks.
−Removed: The Company describes whether and how risks
−Removed: from identified cybersecurity threats materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or
−Removed: financial condition, under the heading “Disruptions or failures in the Company’s computer systems;
−Removed: cyber and other information security incidents” included as part of our risk factor disclosure at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.
+Added: The Company describes whether and how risks from identified cybersecurity threats materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “Disruptions or failures in the Company’s computer systems;
+Added: cyber and other information security incidents” included as part of our risk factor disclosure at Item 1A of this Annual Report on Form 10-K,
+Added: which disclosures are incorporated by reference herein.
Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management.
The Safety and Risk Committee of the Board is responsible for the oversight of risks from cybersecurity threats.
−Removed: At least semi-annually, the Management Risk Committee and, subsequently, the Safety and Risk Committee of the Board receive an overview of our cybersecurity threat risk management and strategy processes from the Chief Information Officer and the Vice President of Network Services.
+Added: At least semi-annually, the Management Risk Committee and, subsequently, the Safety and Risk Committee of the Board receive an overview of our cybersecurity threat risk management and strategy processes from the Chief Information Officer and Chief Information Security Officer.
These sessions typically cover topics such as data security posture, results from third party assessments, progress towards risk-mitigation-related goals, our incident response plan, cybersecurity vendors and products, and material risks from cybersecurity threats, incidents and developments, as well as the steps management has taken to respond to such risks.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.