4 unchanged sentences
The Company is increasingly dependent on the use of complex technology and systems to run its operations and support its strategic objectives.
−Removed: These technologies and systems include, among others, the Company's website and reservation system;
+Added: These technologies and systems include, among others, the Company's website and
+Added: reservation system;
+Added: mobile application;
flight dispatch and tracking systems;
7 unchanged sentences
and financial planning, management, and accounting systems.
−Removed: Additionally, the Company must receive certain confidential or personal information related to its Customers and
−Removed: Employees to run its business, and the Company's operations depend upon secure collection, processing, retention, and transmission of such information.
+Added: Additionally, the Company must receive and process certain confidential or personal information related to its Customers and Employees to run its business, and the Company's operations depend upon secure collection, processing, retention, and transmission of such information.
Therefore, the performance, reliability, and security of the Company's technology infrastructure and information systems are critical to the Company's operations and initiatives.
4 unchanged sentences
The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities.
−Removed: The Company takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company’s operations, finances, legal or regulatory compliance, or reputation.
−Removed: Once identified, cybersecurity risks and related mitigation efforts are prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors.
−Removed: Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk.
+Added: The Company takes a risk-based, threat-informed approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company’s operations, finances, legal or regulatory compliance, or reputation.
+Added: Once identified, cybersecurity risks and related mitigation efforts are evaluated and prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors.
+Added: Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk or threat.
These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and Employee training, education, and awareness initiatives.
−Removed: The Company’s cybersecurity risk management also includes a Security Operations Center (“SOC”) that conducts ongoing monitoring of networks and systems for potential signs of suspicious activity.
+Added: The Company’s cybersecurity program also includes a Security Operations Center (“SOC”) that conducts ongoing monitoring of networks and systems for potential signs of suspicious activity.
The SOC is a centralized function that monitors security alerts to initiate triage, verification, and remediation activities.
1 unchanged sentence
The Company tracks key performance indicators and cybersecurity metrics to evaluate the efficacy of its cybersecurity controls and practices.
−Removed: Further, the Company’s cybersecurity program is periodically reviewed by its Cybersecurity Leaders (as defined below) and adjusted in an effort to maintain the program’s agility and responsiveness as circumstances evolve, new cybersecurity threats emerge, and regulations change.
+Added: Further, the Company’s cybersecurity program is periodically reviewed by its Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO" and, together with the CIO, the Company’s “Cybersecurity Leaders”) and adjusted in an effort to maintain the program’s agility and responsiveness as circumstances evolve, new cybersecurity threats emerge, and regulations change.
Incident Response
The Company has a dedicated cybersecurity incident response team responsible for managing and coordinating the Company’s cybersecurity incident response efforts.
−Removed: This team also collaborates closely with other teams in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents.
+Added: This team collaborates closely with other internal teams as well as with external legal advisors, communication specialists, and other key stakeholders, as appropriate, in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents.
Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance.
Additionally, this team tracks cybersecurity incidents to help identify and analyze them.
−Removed: The Company’s cybersecurity incident response team partners with the Company’s internal cybersecurity teams as well as with external legal advisors, communication specialists, and other key stakeholders as appropriate to respond to cybersecurity incidents.
The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents.
−Removed: The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management.
+Added: The incident response plan includes standard processes for reporting and escalating cybersecurity incidents, as appropriate, to senior management, the Audit Committee, and the Board.
Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario.
−Removed: This preparedness exercise is intended to provide hands-on training for the participants and helps the Company assess its processes and capabilities in addressing cybersecurity threats.
+Added: This preparedness exercise is intended to provide hands-on training for the participants and helps the Company assess its cybersecurity response plan and its processes and capabilities in addressing cybersecurity threats.
Use of Third Parties
Cybersecurity Service Providers and Third-Party Consultants .
−Removed: The Company engages cybersecurity consultants, auditors, and other third parties to assess and enhance its cybersecurity practices.
−Removed: These third parties conduct assessments, penetration testing, and vulnerability assessments to identify weaknesses and recommend
−Removed: improvements.
−Removed: Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions.
−Removed: This includes a managed security service provider to augment the Company’s dedicated SOC team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.
+Added: The Company engages cybersecurity consultants, assessors, and other third parties to assess and enhance its cybersecurity practices.
+Added: These third parties conduct assessments, penetration testing, and vulnerability evaluations to help identify potential weaknesses and recommend improvements.
+Added: Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions, such as a managed security service provider to augment the Company’s dedicated SOC team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.
Oversight of Third-Party Service Providers .
The Company also uses third-party service providers to support its operations and many of its technology initiatives.
−Removed: The Company evaluates third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider’s cybersecurity posture or a recommendation of specific mitigation controls.
+Added: The Company evaluates third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider’s cybersecurity posture and/or a recommendation of specific mitigation activities.
Following an evaluation, the Company determines and prioritizes service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.
Risks from Material Cybersecurity Threats
−Removed: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization.
−Removed: Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company.
−Removed: For a detailed discussion of the Company’s cybersecurity related risks, see “Item 1.A Risk Factors—Information Technology Risks.”
+Added: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably likely to have a material effect on the Company's business strategy, results of operations, or financial condition.
+Added: Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company and its service providers have experienced cyber-attacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place.
+Added: For a detailed discussion of the Company’s cybersecurity related risks, see “Item 1A Risk Factors—Information Technology, Cybersecurity, and Data Privacy Risks.”
Cybersecurity Governance
3 unchanged sentences
The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, members of senior management, and other personnel and advisors, as requested by the Board , report on the Company’s financial, operating, and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board.
−Removed: Based on these reports, the Board requests follow-up data and presentations to address any specific concerns and recommendations.
+Added: Based on these reports, the Board may request follow-up information and presentations to address any specific concerns and recommendations.
Additionally, the Audit Committee has opportunities to report regularly to the entire Board and review with the Board any major issues that arise at the committee level, which may include cybersecurity risks.
The Audit Committee.
−Removed: The Audit Committee reviews with management the Company’s technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile at its regularly scheduled meetings.
−Removed: The Company’s Chief Information Officer (“CIO”), Chief Information Security Officer (“CISO”), members of the cybersecurity team, or other advisors, as requested by the Audit Committee, report quarterly on the Company’s technology, data privacy, and cybersecurity strategies and risks.
+Added: The Audit Committee reviews with management the Company’s technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile as needed at its regularly scheduled meetings.
+Added: The Company’s CIO, CISO, members of the cybersecurity team, or other advisors, as requested by the Audit Committee, report quarterly on the Company’s technology, data protection, and cybersecurity strategies and risks.
Cybersecurity topics are presented to the Audit Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics.
Management believes that this regular cadence of reporting helps to provide the Audit Committee with an informed understanding of the Company’s dynamic cybersecurity program and threat landscape.
−Removed: The Audit Committee further reviews with management the Company’s business continuity and disaster recovery plans and capabilities and the effectiveness of the Company’s escalation procedures.
−Removed: Based on these management reports, the Audit Committee may request follow-up data and presentations to address any specific concerns and recommendations.
−Removed: In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on as needed basis to the Audit Committee.
+Added: As needed, the Audit Committee reviews with
+Added: management the Company’s business continuity and disaster recovery plans and capabilities and the effectiveness of the Company’s escalation procedures.
+Added: Based on these management reports, the Audit Committee may request follow-up information and presentations to address any specific concerns and recommendations.
+Added: In addition to this regular reporting, cybersecurity risks or threats may also be escalated on an as-needed basis to the Audit Committee.
Management’s Role
1 unchanged sentence
The Company’s cybersecurity function is led by the Company’s CISO , who reports to the Company’s CIO.
−Removed: The CISO and CIO (collectively, the Company’s “Cybersecurity Leaders”) are actively involved in assessing and managing cybersecurity risks.
+Added: The Cybersecurity Leaders are actively involved in assessing and managing cybersecurity risks.
They are responsible for implementing cybersecurity policies, programs, procedures, and strategies.
2 unchanged sentences
The CIO holds an undergraduate degree from Cornell and has served in various roles in information technology for over 20 years, including Vice President, Senior Director, Manager and Consultant.
−Removed: • The CISO is responsible for all aspects of cybersecurity across the Company’s facilities, airports, and aircraft fleet, which includes security engineering, security operations, incident response, threat intelligence, risk and compliance, and vulnerability management.
−Removed: The CISO has served in various roles in information technology for nearly 40 years at numerous technology companies and consulting firms.
−Removed: The CISO earned a Bachelor of Science in Industrial Engineering from Louisiana State University, a Master of Science in Management Information Systems from The University of Texas at Dallas, and a Master of Business Administration from Southern Methodist University.
−Removed: The Company’s cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, security architecture, and incident response.
+Added: • The CISO is responsible for leading the Company’s cybersecurity strategy and department while ensuring the protection of data and assets across the Company’s facilities, airports, and aircraft.
+Added: The CISO has served in various roles in cybersecurity for over 15 years.
+Added: The CISO earned a Bachelor of Business Administration in Management Information Systems from The University of Oklahoma and holds a Certified Information Systems Security Professional certification.
+Added: The CISO also participates in the Aviation Information Sharing and Analysis Center Board and is the Vice Chair of the Cybersecurity Council at Airlines for America.
+Added: The Company’s cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, incident response, security operations, vulnerability management, risk and compliance and security engineering.
These teams conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities.
−Removed: Leaders from each team regularly meet with the Cybersecurity Leaders to provide visibility of major issues and seek alignment with strategy.
−Removed: As noted above under “Incident Response,” the Company’s cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management.
+Added: Leaders from each team regularly meet with the Cybersecurity Leaders to provide visibility of relevant issues and seek alignment with strategy.
+Added: As noted above under “Incident Response,” the Company’s cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents, as appropriate, to senior management, the Audit Committee, and the Board.
Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance.
−Removed: The Company’s incident response team also coordinates with external legal advisors, communication specialists, and other key stakeholders.
+Added: The Company’s incident response team also coordinates, as needed, with external legal advisors, communication specialists, and other key stakeholders.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.