5 unchanged sentences
Cybersecurity is a critical component of this program given the increasing reliance on technology and potential of cyber threats.
−Removed: Our Chief Information Security Officer (the "CISO") is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Senior Management Team (“SMT”), and, as discussed below, periodically to our Board of Directors.
−Removed: As part of our overall enterprise risk management program, we maintain both an Information & Cyber Security Program Policy (“ICSPP”) and Information & Cyber Security Response Policy (“ICSRP”).
−Removed: Our ICSPP is overseen by the SMT who is responsible for designating the CISO.
+Added: Our Chief Information Security Officer (the "CISO") is primarily responsible for this cybersecurity component and is a key member of the risk management organization, reporting directly to the Senior Management Team (“SMT”) and our Tech Oversight Committee.
+Added: Our Tech Oversight Committee includes members of our Board and management.
+Added: Our CISO has served in this capacity for more than a decade and maintains multiple certifications issued by the Information Systems Audit and Control Association ("ISACA") and the SANS Institute.
+Added: As part of our overall enterprise risk management program, we maintain both an Information & Cyber Security Program Policy (“ICSPP”) and Information & Cyber Security Incident Response Policy (“ICSIRP”).
+Added: Our ICSPP is overseen by the SMT, which is responsible for designating the CISO.
The CISO is responsible for leading company-wide cybersecurity strategy, policy, standards, architecture, and processes.
The CISO is charged with all logical security related matters, which include but are not limited to, PC/server security, network security, internet security, and database and application security.
−Removed: Our ICSRP is based on applicable federal and state laws as well as cybersecurity incident response best practices.
−Removed: The purpose of the ICSRP is to define procedures for reporting and responding to cybersecurity incidents.
+Added: Our ICSIRP is based on applicable federal and state laws as well as cybersecurity incident response best practices.
+Added: The purpose of the ICSIRP is to define procedures for reporting and responding to cybersecurity incidents.
It creates objectives for actionable procedures that can be measured, evaluated, scaled and revised as necessary for each specific incident.
These objectives include maximizing the effectiveness of our company's operations through an established plan of action and assigning responsibilities to appropriate personnel and/or third -party contractors.
−Removed: Our company has engaged a third-party managed detection and response company to monitor the security of our information systems around-the-clock, including intrusion detection, and to provide instantaneous alerting should a cybersecurity event occur.
+Added: Our company has engaged a third -party managed detection and response company to monitor the security of our information systems around-the-clock, including intrusion detection and response, and to provide instantaneous alerting should a cybersecurity event occur.
If a cybersecurity threat or cybersecurity incident is identified through our company's information systems, the CISO and Incident Response Team (“IRT”) will take immediate steps to mitigate the threat and assess any damages.
10 unchanged sentences
For more information on how cybersecurity risk could materially affect our company's business strategy, results of operations, or financial condition, please refer to Item 1A Risk Factors.
−Removed: Our company recognizes the importance of safeguarding sensitive customer information.
+Added: Our company recognizes the importance of safeguarding company and customer information.
Therefore, the Board of Directors recognizes that the protection of this information ranks as one of our highest priorities.
−Removed: The Board of Directors is responsible for reviewing and approving the ICSPP and ICSRP at least annually and monitoring material risks facing our company.
+Added: The Board of Directors is responsible for reviewing and approving the ICSPP and ICSIRP at least annually and monitoring material risks facing our company.
+Added: The Board recently added a member who possesses specialized expertise in cybersecurity matters.
+Added: Director Sara A.
+Added: Schmidt currently serves as chief information security officer for US Foods and executive sponsor of the West Michigan Cyber Security Consortium.
The Board has tasked the SMT with overseeing efforts to develop, implement and maintain an effective information and cybersecurity program.
2 unchanged sentences
The Board of Directors also monitors our compliance with legal and regulatory requirements and the risks associated therewith.
−Removed: On a regular basis, the Board of Directors reviews with the SMT significant areas of risk exposure involving cybersecurity.
+Added: On a regular basis, our Tech Oversight Committee reviews with the SMT significant areas of risk exposure involving cybersecurity.
At the direction of the SMT, the CISO and IRT monitor internal and external cybersecurity threats and review and revise our company’s cybersecurity defenses on an ongoing basis.
3 unchanged sentences
and risk management and incident response.
−Removed: The CISO prepares reports on IT general controls and cybersecurity metrics for the SMT and Board of Directors on a regular basis, and the CISO presents those reports to the SMT and Board of Directors and addresses any questions and concerns raised by the SMT and Board of Directors.
−Removed: At least annually, the Board of Directors meets with the CISO in person to discuss cybersecurity in greater detail.
+Added: The CISO prepares reports on IT general controls and cybersecurity metrics for the SMT and Tech Oversight Committee periodically.
+Added: The Board of Directors meets with the CISO periodically to discuss cybersecurity.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.