3 unchanged sentences
Cybersecurity Risk Management and Strategy
−Removed: We recognize the importance of identifying, assessing and managing material risks associated with cybersecurity threats.
−Removed: These risks include, among other things, operational risks;
+Added: We recognize the importance of identifying, assessing and managing material cybersecurity risks, including, among other things, our operations;
intellectual property theft;
−Removed: violation of data privacy or cybersecurity laws and other litigation;
+Added: violation of data privacy or cybersecurity laws;
legal and regulatory risk;
2 unchanged sentences
Our Chief Information Security Officer (“CISO”) manages this program, in collaboration with our business and corporate teams.
−Removed: To identify and assess material risks from cybersecurity threats, our enterprise risk management (“ERM”) program considers cybersecurity risks alongside other company risks as part of a quarterly and ongoing process designed to identify, assess and manage risk exposures over the short-, intermediate- and long-term.
+Added: Cybersecurity risks are integrated into our enterprise risk management (“ERM”) program, which evaluates cybersecurity risks alongside other company risks as part of a quarterly and ongoing process designed to identify, assess and manage risk exposures over the short-, intermediate- and long-term.
In addition, our management-level Information and Technology Risk Oversight Committee (“ITROC”), led by our CISO, and including senior leaders such as our President and COO, CFO and General Counsel, among others, provides oversight relating to cybersecurity and technology-related risks that may present significant impacts to our operations, clients, reputation and financial position, and the considerations of the ITROC are fully incorporated into our overall ERM framework.
−Removed: Our CISO is also a member of the Company’s Disclosure Committee and reports to the Disclosure Committee on a quarterly basis on any major cybersecurity incidents.
−Removed: We also have cybersecurity specific policies, standards and procedures, and our cybersecurity program has been developed based on industry standards, including the U.S.
+Added: Our CISO also provides updates to our Disclosure Committee on material cybersecurity incidents.
+Added: We also have cybersecurity-specific policies, standards and procedures, and our cybersecurity program aligns with industry standards, including the U.S.
National Institute of Standards and Technology (“NIST”) cybersecurity framework and International Organization for Standardization (“ISO”) information security standards.
Our information security management system has achieved ISO 27001:2022 certification.
−Removed: To provide for the resilience of critical data and systems, to maintain regulatory compliance, to manage our material risks from cybersecurity threats, and to protect against, detect and respond to cybersecurity incidents, we regularly undertake the below listed activities:
+Added: To help ensure the resilience of critical data and systems, maintain regulatory compliance, manage material cybersecurity risks, and protect against, detect and respond to cybersecurity incidents, we regularly undertake the following activities:
• 24x7x365 security operations monitoring of our systems, networks and services to detect and act on weaknesses and potential intrusions;
4 unchanged sentences
• Business resiliency planning with disaster recovery and business continuity testing;
+Added: Table of Content s
• Role-based access controls to identify, authenticate and authorize individuals to access systems based on their job responsibilities;
7 unchanged sentences
• Cybersecurity risk insurance to provide protection against potential losses arising from a cybersecurity incident.
−Removed: Our IT risk program also includes an incident response plan that provides procedures for how we detect, respond to and recover from cybersecurity incidents, which include processes designed to triage, assess severity, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.
+Added: Our IT risk program also includes an incident response plan that provides for how we detect, respond to and recover from cybersecurity incidents, which include processes designed to triage, assess severity, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our brand and reputation.
As part of the above processes, we regularly engage with assessors, consultants, auditors and other third parties, including by annually having a third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance.
1 unchanged sentence
Cybersecurity considerations affect the selection and oversight of our third-party service providers.
−Removed: Although we perform diligence on third parties that have access to our systems, networks, data or facilities that house such systems, networks or data, and we monitor cybersecurity threat risks identified through such diligence, there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, networks and other assets owned or controlled by third parties.
−Removed: Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.
+Added: Although we perform diligence on third parties and monitor cybersecurity threat risks identified through such diligence, we cannot guarantee that we can prevent or mitigate the risk of any compromise or failure in the information systems, software, networks and other assets owned or controlled by third parties.
In the last three fiscal years we have not identified any material cybersecurity incidents and have not identified any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, and the expenses we have incurred from any cybersecurity incidents over the last three fiscal years were immaterial.
5 unchanged sentences
The Audit and Risk Committee (the “Audit Committee”) of our Board is responsible for the oversight of risks from cybersecurity threats.
−Removed: On a quarterly basis, our CISO updates the Audit Committee on the Company’s IT risk program, including an overview of risks and trends, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat developments, as well as the steps management has taken to respond to these topics.
+Added: On a quarterly basis, our CISO updates the Audit Committee on the Company’s IT security program, including an overview of risks and trends, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and cybersecurity threat developments, as well as the steps management has taken to respond to these topics.
This quarterly update is also made available to the full Board, and the Chair of the Audit Committee informs the Board of any key updates during quarterly reports to the Board.
−Removed: Members of the Board are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related events and to discuss any updates to our cybersecurity risk management and strategy programs.
−Removed: Material cybersecurity risks are also considered during Board and Committee discussions of important matters such as enterprise risk management, operational and strategic planning, business continuity planning, mergers and acquisitions, reputation management and other relevant matters.
−Removed: The Board also conducts an annual education session on cybersecurity trends and risks.
+Added: Material cybersecurity risks are also considered during Board and Committee discussions of matters such as enterprise risk management, operational and strategic planning, business continuity planning, mergers and acquisitions, reputation management and other relevant matters.
+Added: The Board periodically conducts education sessions on cybersecurity trends and risks.
Our cybersecurity risk management processes, which are discussed in greater detail above, are led by our CISO , who has over 20 years of work experience relating to cybersecurity, including at major financial institutions and consulting firms, involving the management of information security and the development of cybersecurity strategy, as well as relevant degrees and certifications, including holding a Bachelor of Science degree in Electrical and Computer Engineering.
−Removed: Our CISO oversees a team of approximately 50 professionals charged with the on-going management of our cybersecurity risk and strategy.
−Removed: These employees are informed about, and monitor the prevention, mitigation, detection, and remediation of, cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our ITROC, incident response plan and other processes.
+Added: Our CISO oversees a team of approximately
+Added: Table of Content s
+Added: 50 professionals charged with the ongoing management of our cybersecurity risk and strategy.
+Added: These employees monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents, including through the operation of our ITROC, incident response plan and other processes.
Our cybersecurity team includes managers that have expertise with cybersecurity, as demonstrated by prior work experience, possession of a cybersecurity certification or degrees or other cybersecurity experience.
−Removed: As detailed above, these members of management and management-level committees report to the Audit Committee about cybersecurity threat risks, among other cybersecurity-related matters, at least quarterly.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.