1 unchanged sentence
CYBERSECURITY
−Removed: We assess and identify material risks from cybersecurity threats primarily through the work of our Chief Information Officer (“CIO”) as part of our enterprise risk management (“ERM”) process.
+Added: We assess and identify material risks from cybersecurity threats primarily through the work of our Chief Information Officer (“CIO”) as part of our enterprise risk management (“ERM”) process and through regularly scheduled meetings of our multidisciplinary cyber critical incident response team.
The ERM process, administered by management with input from business leaders and our global and corporate functions, monitors material risks facing Mercury, including cybersecurity threats.
1 unchanged sentence
Our CIO oversees the internal cybersecurity organization headed by our Chief Information Security Officer (our “Cybersecurity Team”).
−Removed: Risks related to cybersecurity threats are reflected in an enterprise risk “heat map,” along with other material risks identified through the ERM process, and any mitigation plans developed to manage such risks are reported to our Board of Directors.
We could be negatively impacted by a security breach, through a cyber-attack, cyber intrusion, insider threat, supply chain incident, or other significant disruption of our IT networks and related systems.
See “Item 1A - Risk Factors” in this Annual Report for a further discussion of specific risks related to cybersecurity threats.
−Removed: Our Cybersecurity Team monitors activity, scans applications and systems for vulnerabilities to risk from cybersecurity threats, and creates action plans to address and track identified cybersecurity threats until they have been remediated.
−Removed: Activities and cybersecurity incidents are reported to our cyber critical incident response team and to our CIO, who briefs our Compliance Committee, a dedicated committee of senior management focused on regulatory compliance.
+Added: Our Cybersecurity Team monitors activity, scans applications and systems for vulnerabilities and risk from cybersecurity threats, and creates action plans to address and track identified cybersecurity threats until they have been remediated.
+Added: Activities and cybersecurity incidents are reported to our cyber critical incident response team, and the CISO, who briefs our Compliance Committee, a dedicated committee of senior management focused on regulatory compliance.
Our Cybersecurity Team also routinely engages with third parties, including government agencies focused on cyber resiliency, to manage risks from cybersecurity threats.
8 unchanged sentences
Our Cybersecurity Team regularly tests employees throughout the year to assess the effectiveness of our cybersecurity training.
−Removed: We also conduct penetration testing of our network, hold tabletop exercises of cyber incidents, and undertake cybersecurity assessments to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.
+Added: We also conduct penetration testing of our network and undertake cybersecurity assessments to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.
Our Board of Directors provides oversight of our ERM process and other guidelines and policies governing the processes by which our CEO and senior management assess our exposure to risk, including risk from cybersecurity threats.
1 unchanged sentence
Our management Compliance Committee reviews our cybersecurity risk across the enterprise and our cybersecurity strategy framework and operational posture.
−Removed: The Compliance Committee also reviews our IT, data security and other systems, processes, policies, procedures and controls to (a) identify, assess, monitor, and mitigate cybersecurity risks;
+Added: The Compliance Committee also reviews our IT, data security and other systems,
+Added: processes, policies, procedures and controls to (a) identify, assess, monitor, and mitigate cybersecurity risks;
(b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and our other assets or assets of our customers or other third parties in our possession or custody;
1 unchanged sentence
and (d) aid in compliance with legal and regulatory requirements governing cybersecurity or data security reporting requirements.
−Removed: To date, we have not experienced any cybersecurity incidents that have had a material affect on the Company or our financial position, results of operations and/or cash flows.
+Added: To date, we have not experienced any cybersecurity incidents that have had a material effect on the Company or our financial position, results of operations and/or cash flows.
We continue to invest in cybersecurity and enhance the resiliency of our networks and to strengthen our internal controls and processes, which are designed to help protect our systems and infrastructure, and the data they contain.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.