11 unchanged sentences
or lost connectivity to our networked resources.
−Removed: We prioritize cybersecurity and consumer data privacy.
+Added: We prioritize cybersecurity and data privacy.
Our IT department is responsible for coordinating the protection of our information systems and the data they maintain.
+Added: Cybersecurity is an integral part of the Company's Enterprise Risk Management ("ERM").
In order to manage technology risk and secure technology ecosystems, our information security framework is based on the National Institute of Standards and Technology ("NIST") principles, which we execute through our adherence to the Center for Internet Security ("CIS18") control framework.
The CIS18 framework provides us the ability to align measurable controls to actions and benchmark against recognized standards.
−Removed: Using these recognized industry standards, we approach cyber risk
−Removed: management utilizing multiple layers of policies and technology to detect, protect against, and respond to cyberattacks.
+Added: Using these recognized industry standards, we approach cyber risk management utilizing multiple layers of policies and technology to detect, protect against, and respond to cyberattacks.
Following our multi-pronged approach to protecting our systems and data, we:
• administer monthly mandatory ongoing information security training for all employees throughout the year;
−Removed: • maintain privacy policy, security protocols and internal security controls;
+Added: • maintain security protocols and internal security controls;
+Added: • maintain a privacy policy that governs our collection, processing, and securing of personal information;
+Added: • limit collection and storage of information regarding our customers, suppliers and employees;
• use a zero trust network that verifies the device and user identity while restricting network access to only what is needed;
3 unchanged sentences
• use data breach detection software and a cybersecurity operations center that actively monitors our systems;
−Removed: • conduct internal technical cyber incident exercises with the information security team and our third-party cybersecurity service providers;
−Removed: • conduct an annual independent comprehensive security assessment, including penetration and vulnerability testing along with ransomware simulation, to evaluate the security of our environment and provide us the opportunity to understand and address any deficiencies in our security program.
−Removed: We review all technology third party vendors and technology service providers for the following:
−Removed: access management controls including physical safeguards, disaster recovery capabilities, data privacy and notification processes, onboarding processes, incident response procedures, and periodic independent testing of the vendor capabilities.
−Removed: In addition, we review annually the System and Organization Controls ("SOC") Type 1 and SOC Type 2 reports of all of our third-party vendors hosting our data to ensure they conform to those requirements.
−Removed: We also have response and recovery protocols in place to address potential cyberattacks, including a disaster recovery plan and an incident response plan that includes defined incident severities and response matrices.
−Removed: These plans are reviewed and updated at least annually and we maintain third-party cybersecurity insurance.
−Removed: We did not have any material cybersecurity incidents during the fiscal years covered by this report.
+Added: • conduct internal technical cyber incident exercises with our information security team and our third-party cybersecurity service providers;
+Added: • conduct an annual independent comprehensive security assessment, including penetration and vulnerability testing along with ransomware simulation, to evaluate the security of our environment and provide us the opportunity to understand and address identified deficiencies in our security program.
+Added: We review all technology third party vendors and service providers for the following:
+Added: access management controls including physical safeguards, disaster recovery capabilities, data privacy and notification processes, onboarding processes, and incident response procedures.
+Added: In addition, we perform periodic independent testing of vendor capabilities and review the annual System and Organization Controls ("SOC") Type 1 and/or SOC II Type 2 reports of all of our third-party vendors hosting our data to ensure they conform to those requirements.
+Added: Our IT department, lead by our Chief Information Officer ("CIO") , maintains and is responsible for our cybersecurity incident response plans.
+Added: Our cybersecurity incident response plans include processes for evaluating and escalating our response to cybersecurity incidents across our organization, up to and including our senior executive management and Board, and, where required, making public disclosures.
+Added: Cybersecurity threats and incidents (including potential cybersecurity threats and incidents) are identified through our cybersecurity detection, prevention, and mitigation tools and procedures.
+Added: These plans are reviewed and updated at least annually and we maintain third-party cybersecur ity insurance.
+Added: We have not identified any material cybersecurity incidents during the fiscal years covered by this report.
For a discussion of how risks from cybersecurity threats affect our business, see Part I, Item 1A - " Risk Factors – Operational Risks – Information technology failures and data security breaches could harm our business” in this Annual Report on Form 10-K.
−Removed: Cybersecurity and affiliated risks related to our information technology are a key component of our Board of Director’s ("Board") risk oversight.
−Removed: The Audit Committee assists the Board in evaluating our information and cybersecurity risks and overseeing our efforts to mitigate these risks.
−Removed: Our Audit Committee is also responsible for reviewing and analyzing significant financial and operational risks and how management is managing and mitigating such risks through its internal controls and financial risk management processes and is regularly engaged in discussions with management regarding business risks, operational risks, transactional risks, cybersecurity and financial risks.
−Removed: Our Chief Information Officer provides a formal update to our Audit Committee at least twice per year, reviewing cybersecurity risks, trends, plans for future actions and measurements against recognized external cybersecurity frameworks and benchmarks.
−Removed: Our cybersecurity program is led and managed by experienced technology leadership that drives the creation of our security strategy, policies, and procedures as well as possesses expert knowledge in the execution of the related controls and safeguards.
−Removed: Our Chief Information Officer (CIO) has more than 30 years of experience working in information technology including chief information officer roles in the financial services, banking, healthcare, and hospitality sectors.
+Added: Cybersecurity and data privacy risks related to our information technology resources are a key component of our Board's risk oversight.
+Added: The Audit Committee assists the Board in evaluating our cybersecurity and data privacy risks and overseeing our efforts to mitigate these risks.
+Added: Our Audit Committee is also responsible for reviewing and analyzing significant financial and operational risks and how management is managing and mitigating such risks through its internal controls and financial risk management processes and is regularly engaged in discussions with management regarding business risks, operational risks, transactional risks, cybersecurity, enterprise-level and financial risks.
+Added: Our CIO provides a formal update to our Audit Committee at least twice per year, reviewing cybersecurity risks, trends, plans for future actions and measurements against recognized external cybersecurity frameworks and benchmarks and our Vice President of Internal Audit/Compliance conducts an annual ERM survey, which includes cybersecurity risk, and provides the findings to the Board.
+Added: Our cybersecurity program is led and managed by experienced technology leadership that drives the creation of our cybersecurity and data privacy strategy, policies, and procedures and consists of experts in the execution of the related controls and safeguards.
+Added: Our CIO has more than 30 years of experience working in information technology including chief information officer roles in the financial services, banking, healthcare, and hospitality sectors.
While in those roles, the CIO has led governance, risk, and compliance technology programs and information security programs.
−Removed: Supporting the CIO is a dedicated cybersecurity team that designs and monitors cybersecurity control framework as well as implements cybersecurity control systems and solutions.
−Removed: This cybersecurity team collectively holds the following degrees and certifications:
−Removed: Master’s in Cybersecurity, Certified Information Systems Security Professional, Certified Information Security Manager, Microsoft Certified Cybersecurity Architect Expert, Graduate Certificates in Enterprise Cybersecurity and Data Science, Security+ and Certified Information Systems Auditor.
+Added: Supporting the CIO is a dedicated cybersecurity team that designs and monitors cybersecurity control framework and data privacy procedures, as well as implements cybersecurity control systems and solutions.
+Added: This cybersecurity team collectively has experience in:
+Added: cybersecurity, information systems management and security, and related fields of focus.
Our corporate office is in a leased building located in Scottsdale, Arizona with approximately 72,000 square feet and a September 30, 2035 lease expiration.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.