7 unchanged sentences
While the Audit Committee is responsible for evaluating cyber-risks and overseeing the management of these risks, the entire Board is briefed periodically and considers cyber-risk within the context of enterprise risk facing the organization.
−Removed: Our cyber risk management program is based on recognized best practices for cybersecurity and information technology including the National Institute of Standards and Technology (“NIST”) Cyber Security Framework (“CSF”) and Payment Card Industry Data Security Standard (“PCI DSS”).
−Removed: We have implemented an information security program, which is overseen by our CIO and our Sr.
−Removed: Director, Security & Infrastructure, that consists of controls designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats.
−Removed: Both our CIO and our Sr.
−Removed: Director, Security & Infrastructure each have extensive experience assessing and managing cybersecurity programs and cybersecurity risk across a mix of public and large, private enterprises in the retail space.
−Removed: Director, Security & Infrastructure has over 25-years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.
+Added: Our cyber risk management program is based on recognized best practices for cybersecurity and information technology including the National Institute of Standards and Technology (“NIST”) Cyber Security Framework (“CSF”) and Payment Card Industry Data Security Standard.
+Added: We have implemented an information security program, which is overseen by our CIO and our CISO, that consists of controls designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats.
+Added: Both our CIO and our CISO each have extensive experience assessing and managing
+Added: cybersecurity programs and cybersecurity risk across a mix of public and large, private enterprises in the retail space.
+Added: Our CISO has over 25-years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.
Leaders and team members who support our information security program have relevant education and industry experience, including various cybersecurity industry certifications.
3 unchanged sentences
IT leadership initially reviews these incidents, and this information is shared with our Cyber Disclosure Committee, as required.
−Removed: The Cyber Disclosure Committee is comprised of the Company's VP & General Counsel, the Senior Director, Security & Infrastructure, and the VP & Controller.
+Added: The Cyber Disclosure Committee is comprised of the Company's VP & General Counsel, the CISO, and the VP, CAO & Treasurer.
The process requires that any incidents deemed to be potentially material under the Incident Response Plan are immediately escalated in accordance with the Plan to the CEO, other senior leaders of the organization, the Audit Committee Chair, and the full Board as appropriate to formalize the materiality assessment and apprise them of the situation.
5 unchanged sentences
Murphy USA relies on numerous third-parties to deliver the goods and services offered to our customers.
−Removed: We maintain a third-party risk management program to evaluate, prioritize, mitigate and remediate risks associated with third-parties;
−Removed: however, we rely on those third-parties to implement security programs commensurate with their risk and we cannot ensure in all circumstances that their efforts will be successful.
+Added: We maintain a third-party risk management program to evaluate, prioritize, mitigate and remediate cybersecurity risks associated with third-parties;
+Added: however, we rely on those third-parties to implement cybersecurity programs commensurate with their risk and we cannot ensure in all circumstances that their efforts will be successful.
"Risk Factors" for a discussion of cybersecurity risks.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.