4 unchanged sentences
We understand that threats from hackers and other cyber criminals continues to adapt and become more sophisticated, and so must our response to these threats.
−Removed: Our Board of Directors (“the Board”) is responsible for oversight of our information security program.
−Removed: The Audit Committee, Enterprise Risk Committee, and the Information Technology Leadership Team support the Board in the oversight of our information security program and are focused on cybersecurity and data privacy risk, including compliance with all applicable laws and regulations, incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.
−Removed: The Divisional Vice President of IT has a biannual meeting with the Audit Committee and other senior executives to provide an update of our current cyber security posture, IT Risk assessment, and compliance with multiple applicable regulations, frameworks, and other privacy initiatives.
−Removed: The Divisional Vice President of IT, along with the Information Technology Leadership Team, also meet with other senior executives every other week throughout the year to discuss on-going cyber security and governance initiatives and risk mitigations.
−Removed: The Divisional Vice President of IT has fifteen years of cybersecurity
−Removed: experience, including ten years with Mistras Group, and the Information Technology Leadership Team has a combined fifteen years of cybersecurity experience, including a combined ten years with Mistras Group.
−Removed: The Divisional Vice President of IT and members of the Information Technology Leadership Team maintain industry recognized credentials relevant to their roles.
−Removed: The Divisional Vice President of IT manages both an Information Security team and an IT Risk team within the Department of Information Technology.
−Removed: The IT Risk team is responsible for governance and compliance related to regulations and frameworks for data classification, data privacy, handling of private data and CUI, and internal policies and procedures.
+Added: Our Board is responsible for oversight of our cybersecurity program.
+Added: The Audit Committee, Enterprise Risk Committee, and the Information Technology Leadership Team support the Board in the oversight of our information security program and are focused on cybersecurity and data privacy ris k, including compliance with all applicable laws and regulations, incident response
+Added: planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.
+Added: Our cybersecurity risk management and internal controls program are aligned to ISO27001 Standards and the National Institute of Standards and Technology (NIST) framework.
+Added: As part of our cybersecurity program management activities and our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures, we actively engage internal and prominent external experts, as well as industry participants.
+Added: Our cybersecurity program is managed by the Chief Information Officer who has biannual meetings with the Audit Committee and provides periodic reports and updates concerning our cybersecurity program to our Chief Executive Officer and other members of our senior management, as appropriate.
+Added: These reports include updates on our cyber risk and threats, the status of projects to strengthen our information network and data security, assessments of our information security program, and the emerging threat landscape.
+Added: We have established governance committees to provide us with cybersecurity oversight with supportive roles to advance the effectiveness of our cybersecurity program.
+Added: The Chief Information Officer has over 20 years of IT leadership and cybersecurity experience, and the Information Technology Leadership Team overall has a combined fifteen years of cybersecurity experience.
+Added: The Chief Information Officer and members of the Information Technology Leadership Team maintain industry recognized credentials relevant to their roles and stay informed on the latest trends and technologies.
+Added: The Chief Information Officer manages both an Information Security team and an IT Risk team within the Department of Information Technology.
+Added: The IT Risk team works closely with our Data Privacy Officer for governance and compliance related to regulations and frameworks for data classification, data privacy, handling of private data and controlled unclassified information, and internal policies and procedures.
The Cyber Security team is responsible for identifying and implementing technologies to mitigate IT risk, enhance data security, and identify and defend against attacks.
19 unchanged sentences
Web site, code, and configuration vulnerability scans are performed as necessary to ensure that changes do not introduce vulnerabilities into our systems.
−Removed: Information Security and IT Risk personnel receive regular training to ensure up-to-date expert knowledge.
+Added: Information Security and IT Risk personnel receive regular training to ensure these individuals have up-to-date expert knowledge.
To supplement our cybersecurity risk assessment, identification, management, and mitigation efforts, we engage third party cyber security experts.
−Removed: Cyber security assessments are performed at least annually, results are documented and reviewed, and mitigation plans are put in place to reduce any threats identified.
+Added: Cyber security assessments are performed at least annually, results are documented and reviewed, and
+Added: mitigation plans are put in place to reduce any threats identified.
The classification of data processed by any system is considered when implementing mitigations.
4 unchanged sentences
However, cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them.
−Removed: While we have implemented measures to safeguard our operational and technology systems and have established a culture of continuous learning, monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may
−Removed: not always be effective.
+Added: While we have implemented measures to safeguard our operational and technology systems and have established a culture of continuous learning, monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective.
However, as of the date of this Annual Report, management has determined that none of the cybersecurity attacks that we have experienced has resulted in a material impact on our financial condition, results of operations or business strategy.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.