3 unchanged sentences
As a global company, we utilize and rely upon information technology systems in many aspects of our business, including internal and external communications and the management of our accounting, financial, production and supply chain functions.
−Removed: As we become more dependent on information technologies to conduct our operations, and as the number and sophistication of cyberattacks increase, the risks associated with cybersecurity increase.
+Added: As we become more dependent on information technologies to conduct our operations, and as the number of cyberattacks increase and their sophistication evolves, the risks associated with cybersecurity also increase and evolve.
Failure to effectively anticipate, prevent, detect and recover from the increasing number and sophistication of cyberattacks could have a material adverse effect on our results of operations or financial condition.
4 unchanged sentences
We have a Governance Risk and Compliance team which is a dedicated team within the cybersecurity department that focuses on identifying and mitigating cybersecurity and compliance risk.
−Removed: The team works closely with the Information Technology department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.
+Added: The team works closely with the Operations Technology and Information Technology department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.
+Added: As part of our third-party risk management program, we review risk ratings and control assessments of pertinent vendors and other third-parties.
Our Enterprise Risk Management committee, which is comprised of members of our executive leadership team, reviews and evaluates key risks identified through cybersecurity risk management processes.
Mosaic develops and continues to refine mitigation plans that adhere to industry best practices.
−Removed: Regularly, Mosaic engages external vendors to provide independent insight to overall cybersecurity program effectiveness and to assist with evaluating response preparedness.
−Removed: As part of our third-party risk oversight, we regularly review the vendor's ratings and conduct assessments and interviews with their personnel.
−Removed: The results are then reported to leaders in the Information Technology department.
+Added: Regularly, Mosaic regularly engages external vendors to provide independent insight to overall cybersecurity program effectiveness and to assist with evaluating response preparedness.
Board of Director Oversight
The Board of Directors oversees Mosaic’s Enterprise Risk Management program, and the Audit Committee is tasked with oversight of risk from cybersecurity threats.
−Removed: The Board receives an annual cybersecurity update while the Audit Committee receives reports from the Chief Information Security Officer ( “ CISO ”) and Chief Information Officer ( “ CIO ”) regularly.
+Added: The Board receives an annual cybersecurity update while the Audit Committee regularly receives reports from the Chief Information Security Officer ( “ CISO ”) and Chief Information Officer ( “ CIO ”) .
The reports to the Audit Committee include updates on key performance indicators and key risk indicators, including short-term, intermediate-term and emerging risks.
3 unchanged sentences
The Information Technology organization is led by the CIO who is responsible for cybersecurity and risk management, with oversight by the Audit Committee.
−Removed: The cybersecurity program is overseen by the Mosaic’s CISO and supporting
+Added: The cybersecurity program is overseen by the Mosaic’s CISO and supporting cybersecurity leadership, who lead teams to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, Mosaic.
+Added: The CISO, along with the leadership team, possess many years of relevant information technology, cybersecurity and risk management experience in the manufacturing, electric, defense, financial and
Table of Content
−Removed: cybersecurity leadership, who lead teams to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, Mosaic.
−Removed: The CISO, along with the leadership team, possess many years of relevant Information Technology, cybersecurity and risk management experience in the manufacturing, electric, defense, financial and retail sectors.
+Added: retail sectors.
Educational backgrounds include advanced degrees and certifications, such as Certified Information Systems Security Professional.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.