4 unchanged sentences
The Company is increasingly dependent on the use of complex technology and systems to run its operations and support its strategic objectives.
−Removed: These technologies and systems include, among others, the Company's website and
−Removed: reservation system;
+Added: These technologies and systems include, among others, the Company's website and reservation system;
mobile application;
26 unchanged sentences
The Company has a dedicated cybersecurity incident response team responsible for managing and coordinating the Company’s cybersecurity incident response efforts.
−Removed: This team collaborates closely with other internal teams as well as with external legal advisors, communication specialists, and other key stakeholders, as appropriate, in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents.
+Added: This team collaborates closely with other internal teams as well as with external experts such as legal advisors, communication specialists, and other key stakeholders, as appropriate, in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents.
Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance.
1 unchanged sentence
The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents.
−Removed: The incident response plan includes standard processes for reporting and escalating cybersecurity incidents, as appropriate, to senior management, the Audit Committee, and the Board.
+Added: The incident response plan includes standard processes for reporting and
+Added: escalating cybersecurity incidents, as appropriate, to senior management, the Audit Committee, and the Board.
Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario.
12 unchanged sentences
Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company and its service providers have experienced cyber-attacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place.
−Removed: For a detailed discussion of the Company’s cybersecurity related risks, see “Item 1A Risk Factors—Information Technology, Cybersecurity, and Data Privacy Risks.”
+Added: For a detailed discussion of the Company’s cybersecurity related risks, see “Item 1A.
+Added: Risk Factors—Information Technology, Cybersecurity, and Data Privacy Risks.”
Cybersecurity Governance
7 unchanged sentences
The Audit Committee reviews with management the Company’s technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile as needed at its regularly scheduled meetings.
−Removed: The Company’s CIO, CISO, members of the cybersecurity team, or other advisors, as requested by the Audit Committee, report quarterly on the Company’s technology, data protection, and cybersecurity strategies and risks.
−Removed: Cybersecurity topics are presented to the Audit Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics.
+Added: The Company’s CIO, CISO, members of the cybersecurity team, or other advisors, as requested by the Audit Committee, report periodically on the Company’s technology, data protection, and cybersecurity strategies
+Added: Cybersecurity topics are presented to the Audit Committee on a periodic basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics.
Management believes that this regular cadence of reporting helps to provide the Audit Committee with an informed understanding of the Company’s dynamic cybersecurity program and threat landscape.
−Removed: As needed, the Audit Committee reviews with
−Removed: management the Company’s business continuity and disaster recovery plans and capabilities and the effectiveness of the Company’s escalation procedures.
+Added: As needed, the Audit Committee reviews with management the Company’s business continuity and disaster recovery plans and capabilities and the effectiveness of the Company’s escalation procedures.
Based on these management reports, the Audit Committee may request follow-up information and presentations to address any specific concerns and recommendations.
6 unchanged sentences
The responsibilities and relevant experience of each of the Cybersecurity Leaders are listed below:
−Removed: • The CIO provides leadership for the Company’s technology department.
−Removed: The CIO holds an undergraduate degree from Cornell and has served in various roles in information technology for over 20 years, including Vice President, Senior Director, Manager and Consultant.
−Removed: • The CISO is responsible for leading the Company’s cybersecurity strategy and department while ensuring the protection of data and assets across the Company’s facilities, airports, and aircraft.
+Added: • The Executive Vice President and CIO provides leadership for the Company’s technology department.
+Added: The CIO holds an undergraduate degree from Cornell University and has served in various roles in information technology for over 20 years, including Senior Vice President, Vice President, Senior Director, Manager, and Consultant.
+Added: • The CISO is responsible for leading the Company’s cybersecurity strategy and department, as well as the protection of data and assets across the Company’s facilities, airports, and aircraft.
The CISO has served in various roles in cybersecurity for over 19 years.
8 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.