1 unchanged sentence
Cybersecurity
−Removed: We are committed to protecting the confidentiality and integrity of our data, as well as the data of our associates and customers.
−Removed: The mission of our cybersecurity program is to protect the assets used to create products, generate revenue, and service customers while complying with industry frameworks.
−Removed: Our cybersecurity program consists of three key pillars:
−Removed: cyber defense, governance and compliance, and risk management.
−Removed: Each of these pillars consists of controls and processes that are aligned with the National Institute of Standards and Technology Cyber Security Framework.
+Added: We have developed our cybersecurity program to protect the assets used to create products, generate revenue, and service customers while complying with industry frameworks.
+Added: We are also committed to protecting the confidentiality and integrity of our data, as well as the data of our associates and customers.
+Added: Our cybersecurity program consists of key pillars focused on:
+Added: risk management and cyber defense, as well as governance and compliance.
+Added: Each of these pillars consists of controls and processes that are aligned with the National Institute of Standards and Technology (“NIST”) Cyber Security Framework.
Managing cybersecurity risk and maintaining a secure, reliable and functional corporate network and data systems are among our highest priorities.
−Removed: As a result, we have implemented practices, procedures, processes, and management mechanisms to help us achieve a robust cybersecurity environment.
−Removed: Our Board delegates to the Audit Committee the oversight of our programs, policies, and procedures related to cybersecurity, information asset security, network security, and data privacy and protection.
−Removed: Broad oversight is maintained by our full Board, which receives a report from the Audit Committee at least annually.
−Removed: Our VP, Cyber Security and Risk oversees our cybersecurity matters and has over 20 years of experience in cybersecurity and is a Certified Information Security Services Professional (CISSP).
−Removed: Our VP, Cyber Security and Risk reports to both the Audit Committee and the Board at least once a year, or more frequently as needed.
−Removed: The Audit Committee reviews and discusses with Company management key process and risk indicators, progress on plans to address keys risks, and any material changes in threat landscapes or risk posture which could negatively affect our business.
+Added: As a result, we have implemented practices, procedures, processes and governance mechanisms to help us achieve a robust cybersecurity environment.
Risk Management and Strategy
Cybersecurity risk management is a critical component of our overall enterprise risk management program.
−Removed: We consider cybersecurity to be a key risk, and we prioritize mitigating those risks.
−Removed: Our cyber defense practices prioritize protection against cyber threats.
+Added: We consider cybersecurity to be a key risk, and we prioritize risks related to cybersecurity matters.
+Added: Risk Assessment and Identification
+Added: Our cyber defense practices prioritize protection against cybersecurity threats.
We have operationalized a written incident response plan designed to assess, identify, address and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity and availability of our business and information systems.
−Removed: We perform periodic cybersecurity assessments, including with the assistance of external third parties, to identify, assess, and prioritize potential risks that could affect our information and data assets and infrastructure.
−Removed: In addition, we use a threat intelligence platform to routinely monitor risks specific to both our organization and third parties.
−Removed: Risks we identify are assessed based on severity and are addressed as appropriate through both tactical and strategic plans.
−Removed: Our governance and compliance practice focuses on cybersecurity and data privacy policy taxonomy and policy compliance.
+Added: We use a threat intelligence platform to routinely monitor risks specific to both our organization and third parties.
+Added: Our incident response playbook and processes are maintained within the cyber defense program and used to keep personnel trained.
+Added: Penetration tests are conducted periodically to validate cyber defense control effectiveness.
+Added: We have also established cybersecurity taxonomy and operational parameters for our company.
+Added: These parameters include acceptable technology and data use, data privacy, access controls, third-party governance and disaster recovery.
+Added: Vulnerability management is also a key focus of our cybersecurity program, which consists of identifying and assessing vulnerabilities and taking appropriate action to manage risk.
+Added: We routinely review our controls and technology use against our policies and assess our cybersecurity program against the NIST Cyber Security Framework.
We have implemented a number of measures to enhance the security and resiliency of our network and information and data systems.
8 unchanged sentences
and (viii) incident response planning.
+Added: We perform periodic cybersecurity assessments, including with the assistance of external third parties, to identify, assess and prioritize potential risks that could affect our information and data assets and infrastructure.
+Added: Risks we identify are assessed based on severity and are addressed as appropriate through both tactical and strategic plans.
+Added: Risk and security maturity assessments, as well as penetration assessments, are performed as part of our cybersecurity program.
+Added: Third Party Risk Management
+Added: We have a process in place to oversee our third-party vendors who have access to our information systems or who hold or store personal information on our behalf.
+Added: We use a variety of methods and tools to assess such third-party vendors’ controls
+Added: related to cybersecurity threats, including obtaining proof of a vendor’s testing of data protection controls, imposition of contractual obligations and reviews of data protection controls such as backups, encryption standards and disaster recovery.
+Added: Our information technology and vendor risk management functions assess such third-party vendors as part of the initial determination process and then periodically thereafter.
Training and Awareness
Our associates are a critical part of our defense against potential cybersecurity incident exposure.
−Removed: All of our associates and contractors have a responsibility and a role to play by complying with our cybersecurity operational practices and reporting any potential cybersecurity incidents or exposures to our cybersecurity team.
−Removed: To ensure that associates can play their part in protecting our networks and data from cybersecurity incident exposure, all of our associates receive cybersecurity training in the form of online modules on an annual basis, routine simulations, and newsletters.
+Added: All of our associates have a responsibility and a role to play by complying with our cybersecurity operational practices and reporting any potential cybersecurity incidents or exposures to our cybersecurity team.
+Added: All applicable associates receive cybersecurity training in the form of online modules on an annual basis, routine simulations and newsletters.
Material Cybersecurity Risks, Threats & Incidents
−Removed: We are not aware of any cyber event that has had a material effect on our business.
−Removed: However, we cannot assure that we will not experience any such event in the future.
+Added: As of the date of this Annual Report on Form 10-K, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, results of operations, or financial condition.
+Added: We cannot assure you that we will not experience any such threats or incidents in the future.
Any security breach or other significant disruption involving our computer networks and related systems could cause substantial costs and other negative effects, including litigation, remediation costs, costs to deploy additional protection strategies, compromising of confidential information and reputational damage adversely affecting investor confidence.
1 unchanged sentence
Risk Factors for further details on risks related to potential breaches of our information technology systems.
+Added: The Audit Committee assists the Board in its oversight of our enterprise risk management program.
+Added: The Audit Committee reviews our strategies, policies and internal controls relating to information technology, data privacy, data protection and cybersecurity.
+Added: The Audit Committee’s review includes our plans to mitigate cybersecurity risks and to respond to data breaches.
+Added: Broad oversight is maintained by our full Board.
+Added: Our Executive Vice President and Chief Digital and Technology Officer (“CDTO”) is responsible for the oversight of our information security strategy and cybersecurity program.
+Added: Our CDTO has over 20 years of information technology experience, leading the development of a multi-year information technology strategy, including cross-functional information technology transformation and digital innovation initiatives.
+Added: Our Vice President, Cyber Security and Risk, who reports directly to the CDTO, is responsible for day-to-day assessment and management of our cybersecurity matters and has over 20 years of experience in enterprise risk management, governance and compliance, defending against cyber threats and is a Certified Information Security Services Professional (“CISSP”).
+Added: Our Vice President, Cyber Security and Risk oversees a cybersecurity team that focuses on the execution of our cybersecurity program, including cyber defense, as well as risk and compliance matters.
+Added: The cybersecurity team receives timely notifications about cybersecurity threats via the threat intelligence platform used by the company.
+Added: In addition, this team leverages third-party security service and threat intelligence partners to operate and maintain our cyber defense program, to stay current on cybersecurity risks and to assess various areas of our operations.
+Added: Our Vice President, Cyber Security and Risk regularly provides updates on material cybersecurity risks to our CDTO and other members of senior management and provides reports to both the Audit Committee and the Board at least once a year, or more frequently as needed.
+Added: The Audit Committee reviews and discusses with our management key process and risk indicators, progress on plans to address keys risks, and any material changes in threat landscapes or risk posture which could negatively affect our business.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.