9 unchanged sentences
and communicating with employees, investors, suppliers, trade customers, adult tobacco consumers and others.
−Removed: Recognizing the critical importance of cybersecurity in today’s digital landscape, we are committed to safeguarding our information assets, protecting consumer
−Removed: data and maintaining the integrity and availability of our systems.
+Added: Recognizing the critical importance of cybersecurity in today’s digital landscape, we are committed to safeguarding our information assets, protecting consumer data and maintaining the integrity and availability of our systems.
Accordingly, we have implemented an extensive cybersecurity risk management framework designed to identify, assess, mitigate and prevent potential cybersecurity risks and to align with industry best practices and all applicable regulatory requirements.
−Removed: We evaluate our cybersecurity risk management framework against the National Institute of Standards and Technology’s Cybersecurity Framework, which outlines the core components and responsibilities necessary to sustain a healthy and well-balanced cybersecurity program.
−Removed: We also align our security standards for infrastructure configuration with the Center for Internet Security’s Benchmarks, which are prescriptive recommendations based upon the consensus of global cybersecurity experts.
+Added: We leverage the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework and industry best practices to identify and prioritize cybersecurity risks based on their potential impacts.
+Added: We also use the NIST framework and industry best practices to drive enhancements to our program that are designed to protect our assets and third-party partners.
+Added: The NIST framework also helps us maintain ongoing compliance with regulatory requirements.
+Added: We align our security standards for infrastructure configuration with the Center for Internet Security’s Benchmarks, which are prescriptive recommendations based upon the consensus of global cybersecurity experts.
Our framework is built around the following key principles:
10 unchanged sentences
We regularly engage third-party consulting services to conduct audits and assessments of the effectiveness of our cybersecurity controls and processes and identify areas for improvement based on developments in industry best practices.
+Added: We typically engage these services
+Added: annually, though the cadence can differ based on the results of the audits and assessments.
We also leverage third parties to evaluate our cybersecurity and risk management strategy, review policies and procedures to address new risks and maintain ongoing compliance with evolving legal and regulatory requirements.
−Removed: For example, we partner with leading global security providers to leverage various threat intelligence channels as input to monitor and tune our controls to prevent a cybersecurity attack.
+Added: For example, we partner with leading global security providers to leverage various threat intelligence channels as input to monitor and tune our cybersecurity controls.
▪ Security Controls:
−Removed: We employ a layered approach to cybersecurity, implementing a range of technical and procedural controls to protect critical systems and data.
−Removed: These controls include (i) firewalls and intrusion detection and prevention systems to monitor and block unauthorized access attempts, detect and prevent malicious activity and safeguard network infrastructure, (ii) encryption, including secure protocols and multi-factor authentication, to protect information in transit and at rest and (iii) secure network architecture that segregates critical systems from the public internet, limiting exposure to potential threats.
+Added: We employ a layered approach to cybersecurity, implementing a range of technical and procedural controls designed to protect critical systems and data.
+Added: These controls include (i) firewalls and intrusion detection and prevention systems to monitor and block unauthorized access attempts, detect and deter malicious activity and safeguard network infrastructure, (ii) encryption, including secure protocols and multi-factor authentication, to protect information in transit and at rest and (iii) secure network architecture that segregates critical systems from the public internet, limiting exposure to potential threats.
We also conduct regular security patching to manage emerging cyber threats.
2 unchanged sentences
These procedures, which our IT Risk Management function reviews on an ongoing basis both internally and with third-party consultants, provide detailed descriptions of the roles and responsibilities of key stakeholders and the procedures for communication and coordination during an incident.
−Removed: The procedures also provide guidelines for escalating information to senior management, our Disclosure Controls Committee, our Audit Committee, which, as discussed below, has been delegated responsibility for our Board’s cybersecurity risk oversight function, and our full Board and for providing timely public disclosure, when necessary.
−Removed: To maintain incident readiness and resilience, we conduct periodic disaster recovery exercises and cybersecurity incident management exercises led by our IT Risk Management function.
+Added: The procedures also provide guidelines for escalating information to senior management, our Disclosure Controls Committee, our Audit Committee, which, as discussed below, has been delegated cybersecurity program oversight responsibility, and our full Board and for providing timely public disclosure, when necessary.
+Added: To maintain incident readiness, business continuity and IT resilience, we conduct periodic disaster recovery exercises and cybersecurity incident management exercises led by our IT Risk Management function.
These exercises involve simulating various scenarios and testing our response strategies, allowing us to identify vulnerabilities, refine procedures and enhance our overall crisis management and recovery capabilities.
4 unchanged sentences
We believe that our Information Governance Policy is aligned with industry best practices and applicable legal and regulatory requirements.
−Removed: In addition to our Information Governance Policy, we conduct regular cybersecurity training programs emphasizing the importance of cybersecurity awareness.
+Added: In addition to our Information Governance Policy, we conduct cybersecurity training programs emphasizing the importance of cybersecurity awareness at least annually and more frequently as necessary or advisable.
These programs address relevant cybersecurity topics, such as common cybersecurity threats, phishing awareness and best practices for safeguarding sensitive information.
4 unchanged sentences
This program relies on key elements including risk assessment, due diligence, contractual provisions and ongoing monitoring to identify and mitigate impacts from high-risk third-parties and of specific risks.
−Removed: We use security risk assessment questionnaire tools to identify high-risk third-parties, allowing us to effectively assess and mitigate potential security vulnerabilities.
+Added: We use security risk assessment questionnaire tools to identify high-risk third-parties, which we believe allows us to effectively assess and mitigate potential security vulnerabilities.
Our third-party risk assessment framework evaluates the cybersecurity practices and controls of third-parties.
−Removed: For high-risk third-parties, we perform rigorous due diligence inquiries, reviewing documentation with respect to their security policies, incident response capabilities, data protection measures and regulatory compliance.
+Added: For high-risk third-parties, we perform due diligence inquiries, reviewing documentation with respect to their security policies, incident response capabilities, data protection measures and regulatory compliance.
We also review evidence of cybersecurity certifications and the results of independent audits.
4 unchanged sentences
Our Board devotes significant time and attention to our cybersecurity and information technology risks.
−Removed: Our Board executes its cybersecurity risk oversight function as a whole and by delegating responsibility to our Audit Committee.
+Added: Our Board executes its cybersecurity risk oversight as a whole and by delegating responsibility to our Audit Committee.
Our CISO and Chief Information Officer present to our Board annually and to our Audit Committee at least twice each year on a broad range of topics, such as recent and potential cybersecurity threats and incidents across our industry, best practices and policies, emerging trends, vulnerability assessments and management’s ongoing efforts to prevent, detect and address internal and external cybersecurity threats specific to us .
−Removed: These briefings also include periodic third-party cybersecurity program assessments and benchmarks and updates from our cybersecurity incident management exercises.
+Added: These briefings also include reporting on periodic third-party cybersecurity program assessments and benchmarks and updates from our cybersecurity incident management exercises.
Cybersecurity risks are documented in an IT Risk Dashboard, which is shared with our Audit Committee for awareness several times each year.
8 unchanged sentences
Our CISO has over 25 years of experience, including five years as our CISO, managing technology risks across multiple industries, including financial services, technology and manufacturing.
−Removed: Through strategic hiring and internal development, our CISO increases the levels of skill and experience on our IT Risk Management team to stay ahead of evolving cybersecurity threats.
+Added: Through strategic hiring and internal development, our CISO enhances the levels of skill and experience on our IT Risk Management team to stay ahead of evolving cybersecurity threats.
As of the date of this filing, 100% of our IT Risk Management team has technical industry certification, and members of the IT Risk Management team have an average of 15 years of cybersecurity experience.
Our CISO currently serves as an advisor to multiple industry groups.
−Removed: Our cybersecurity program undergoes an annual controls effectiveness assessment and bi-annual program maturity evaluation against industry peers and consistently receives assessments indicating that it is ahead of the cybersecurity programs of our peer group.
+Added: Our cybersecurity program undergoes an annual third-party controls effectiveness assessment and bi-annual program maturity evaluation against industry peers and consistently receives assessments indicating that it is ahead of the cybersecurity programs of our peer group.
As of the date of this filing, we are not aware of any current cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business, results of operations or financial condition.
−Removed: For further discussion of the risks related to cybersecurity, see Item 1A.
−Removed: Risk Factors - Risks Relating to Our Business - Information Technology and Data Privacy Risks .
+Added: From time-to-time, we and our third-party service providers, suppliers and trade customers experience attempts to infiltrate and interrupt information systems.
+Added: To date, we have not experienced any interruptions of these information systems as a result of infiltration attempts .
+Added: For further discussion of the risks related to cybersecurity, see Risks Relating to Our Business - Information Technology and Data Privacy Risks in Item 1A .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.