5 unchanged sentences
We take a risk-based approach with our cybersecurity program that has been designed in accordance with the National Institute of Standards and Technology (“NIST”) cybersecurity framework.
−Removed: Our program focuses on a variety of potential material risks including operational (including unauthorized access), financial, reputational and compliance-related.
+Added: Our program focuses on a variety of potential material risks including operational (including unauthorized access and business continuity), financial, reputational and compliance-related.
We analyze these risks based on numerous factors and also weigh their likelihood and potential impact.
−Removed: This analysis is led by our Chief Digital Officer and Chief Information Security Officer as detailed below under “—Governance.” Additionally, we have identified cybersecurity as a credible technology-related risk under our enterprise risk management (“ERM”) program.
−Removed: Our Chief Digital Officer is the owner of our technology risks and is therefore charged with executing controls to monitor and mitigate cybersecurity risks through people, processes and technology.
+Added: This analysis is led by our Chief Digital Officer, Senior Vice President of Technology and Chief Information Security Officer as detailed below under “—Governance.” Additionally, we have identified cybersecurity as a credible technology-related risk under our enterprise risk management (“ERM”) program.
+Added: Our Chief Digital Officer is the owner of our technology risks and is therefore charged with
+Added: executing controls to monitor and mitigate cybersecurity risks through people, processes and technology.
Our ERM Committee is comprised of Company leaders who meet to consider, among other matters, the effectiveness of the risk monitoring and mitigating and the expected frequency, severity and trend of our credible risks including cybersecurity.
−Removed: We seek to continuously improve our program within the NIST framework based on our risk assessment as well as our business needs and industry trends.
+Added: We seek to continuously improve and mature our program within the NIST framework based on our risk assessment, the threat landscape as well as our business needs and industry trends.
We also apply administrative, operational and technical security controls to handle and process our data and the data of our members, guests and employees in a responsible and secure manner, including through various internal policies and standards governing information security.
19 unchanged sentences
Our internal escalation process is set forth in our incident response plan.
−Removed: Our Executive Vice President and Chief Digital Officer is our executive team member responsible for our cybersecurity program and our Chief Information Security Officer (“CISO”) leads the program.
+Added: Our Executive Vice President and Chief Digital Officer is our executive team member responsible for our cybersecurity program and our Chief Information Security Officer (“CISO”) leads the program with the support of our Senior Vice President of Technology.
Together they provide updates to the ERM Committee and present to our Audit Committee at least annually.
2 unchanged sentences
Members of our cybersecurity team have over 100 years of combined cybersecurity experience and hold professional certifications from security organization such as ISC2 and SANS Institute that include Certified Information Systems Security Professional (CISSP), GIAC Web Application Penetration Tester (GWAPT), GIAC Penetration Tester (GPEN), GIAC Certified Intrusion Analyst (GCIA) and GIAC Certified Forensic Analyst (GCFA).
−Removed: Our cybersecurity team also stays informed on the latest developments in cybersecurity, including trends, risks, threat vectors and attack mechanisms, through security and compliance-related seminars, conferences, continuing education training, news feeds and forums and our CISO sits on various CISO committees and roundtables.
−Removed: Our CISO’s knowledge and experience, coupled with the expertise and advice we receive from third parties, are instrumental in assessing and managing our cybersecurity program, including our strategy, security engineering, security operations, cybersecurity awareness and training, information technology governance and compliance, and cyber threat identification, assessment, management, mitigation and response.
+Added: Our cybersecurity team also stays informed on the latest developments in cybersecurity, including trends, risks, threat vectors, impacts and risks from artificial intelligence and attack mechanisms, through security and compliance-related seminars, conferences, continuing education training, news feeds and forums and our CISO sits on various CISO committees and roundtables.
+Added: Our CISO’s knowledge and experience, coupled with the expertise and advice we receive from third parties, are instrumental in assessing and managing our cybersecurity program,
+Added: including our strategy, security engineering, security operations, cybersecurity awareness and training, information technology governance and compliance, and cyber threat identification, assessment, management, mitigation and response.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.