5 unchanged sentences
Our Board is responsible for oversight of our cybersecurity program.
−Removed: The Audit Committee, Enterprise Risk Committee, and the Information Technology Leadership Team support the Board in the oversight of our information security program and are focused on cybersecurity and data privacy ris k, including compliance with all applicable laws and regulations, incident response
−Removed: planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.
−Removed: Our cybersecurity risk management and internal controls program are aligned to ISO27001 Standards and the National Institute of Standards and Technology (NIST) framework.
+Added: The Audit Committee, Enterprise Risk Committee, and the Information Technology Leadership Team support the Board in the oversight of our information security program and are focused on cybersecurity and data privacy ris k, including compliance with all applicable laws and regulations, incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.
As part of our cybersecurity program management activities and our continuing efforts to evaluate and enhance the effectiveness of our cybersecurity policies and procedures, we actively engage internal and prominent external experts, as well as industry participants.
9 unchanged sentences
Risk Management and Strategy
−Removed: The IT Risk team uses an asset-based risk approach for evaluating cybersecurity risks and appropriate risk mitigation.
−Removed: All IT assets are reviewed against a broad range of risks twice a year and are evaluated for likelihood of occurrence and impact should they occur.
−Removed: These risks are then mapped to our global inventory of systems and the type of data as well as the number of systems to which a risk applies are evaluated.
−Removed: These factors are used to determine a risk score for each of the reviewed risks, and mitigations are subsequently applied to reduce those risk scores to determine the areas of focus for increasing mitigations.
−Removed: This exercise is logged biannually to monitor improvement.
+Added: Our IT Risk team conducts assessments of the Company’s most significant IT and cybersecurity risks.
+Added: Assessment results are leveraged by IT leadership, along with other inputs, to mitigate and manage these risks.
+Added: Although no system can eliminate all risks, our risk-based approach ensures that reasonably known threats are identified, and material risks are appropriately addressed.
We have several physical, automated, and administrative controls in place to mitigate the success and extent of any cyber breaches.
8 unchanged sentences
Employees must participate in annual cyber security training.
−Removed: Simulated testing occurs multiple times throughout the year, including drop testing and SPAM / PHISHING campaigns, and the results are tracked for compliance and we address any weaknesses identified in such trainings and testings as necessary.
+Added: Simulated testing occurs multiple times throughout the year, including drop testing and SPAM / PHISHING campaigns, and the results are tracked for compliance and we address any weaknesses identified in such trainings and testing as necessary.
+Added: We have established an AI Oversight Committee, which is responsible for governance and oversight of the use of AI technologies.
+Added: In addition, we have adopted an enterprise AI policy that establishes guardrails for the use of AI by our employees, including requirements related to data protection, confidentiality, and cybersecurity risk management.
The Information Security team performs internal threat hunting, vulnerability scanning, log aggregation, and identity monitoring on an on-going basis.
2 unchanged sentences
To supplement our cybersecurity risk assessment, identification, management, and mitigation efforts, we engage third party cyber security experts.
−Removed: Cyber security assessments are performed at least annually, results are documented and reviewed, and
−Removed: mitigation plans are put in place to reduce any threats identified.
+Added: Cyber security assessments are performed at least annually, results are documented and reviewed, and mitigation plans are put in place to reduce any threats identified.
The classification of data processed by any system is considered when implementing mitigations.
4 unchanged sentences
However, cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them.
−Removed: While we have implemented measures to safeguard our operational and technology systems and have established a culture of continuous learning, monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective.
+Added: While we have implemented measures to safeguard our operational and technology systems and have established a culture of continuous learning, monitoring and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may
+Added: not always be effective.
However, as of the date of this Annual Report, management has determined that none of the cybersecurity attacks that we have experienced has resulted in a material impact on our financial condition, results of operations or business strategy.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.