9 unchanged sentences
The Corporation’s Information Security Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board .
−Removed: Our Information Security Officer has over a decade of experience leading cyber security oversight, and others on our IT security team have cybersecurity experience or certifications.
+Added: Our Information Security Officer has over a decade of experience in cyber security, and others on our IT security team have cybersecurity experience or certifications.
We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources and advisors as needed.
10 unchanged sentences
The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report.
−Removed: If a third-party vendor is not able
−Removed: to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis.
+Added: If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis.
Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.
9 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.