5 unchanged sentences
The Board has designated the Audit Committee as the governing committee for the oversight of Murphy USA’s major information technology risk exposures, including those related to cybersecurity, data privacy, and data security, and to oversee the steps management has taken to monitor and mitigate such risk exposures.
−Removed: The Audit Committee reviews cybersecurity risks through regular updates from management as needed with no fewer than two reports from management per year, and it monitors the status of ongoing projects to enhance existing information security controls and practices and mitigate the potential risk from evolving cybersecurity threats.
+Added: The Audit Committee reviews cybersecurity risks through regular updates from management as needed with typically no fewer than two reports from management in a given annual reporting cycle, and it monitors the status of ongoing projects to enhance existing information security controls and practices and mitigate the potential risk from evolving cybersecurity threats.
While the Audit Committee is responsible for evaluating cyber-risks and overseeing the management of these risks, the entire Board is briefed periodically and considers cyber-risk within the context of enterprise risk facing the organization.
−Removed: Our cyber risk management program is based on recognized best practices for cybersecurity and information technology including the National Institute of Standards and Technology (“NIST”) Cyber Security Framework (“CSF”) and Payment Card Industry Data Security Standard.
+Added: Our cyber risk management program is based on recognized best practices for cybersecurity and information technology including the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”) and Payment Card Industry Data Security Standard.
We have implemented an information security program, which is overseen by our CIO and our CISO, that consists of controls designed to prevent, detect, and manage reasonably foreseeable cybersecurity risks and threats.
−Removed: Both our CIO and our CISO each have extensive experience assessing and managing
−Removed: cybersecurity programs and cybersecurity risk across a mix of public and large, private enterprises in the retail space.
+Added: Both our CIO and our CISO each have extensive experience assessing and managing cybersecurity programs and cybersecurity risk across a mix of public and large, private enterprises in the retail space.
Our CISO has over 25 years of industry experience, including serving in similar roles leading and overseeing cybersecurity programs at other public companies.
2 unchanged sentences
Any identified incidents are documented and reviewed in accordance with the Company's Incident Response Plan.
−Removed: This Plan lays out the criteria for classification of risk associated with identified issues based on the potential impact and likelihood of a material, adverse impact on the business, financial condition, results from operation, cash flows or reputation.
+Added: This Plan lays out the criteria for classification of risk associated with identified issues based on the potential impact and likelihood of a material, adverse impact on the business, financial condition, results of operations, cash flows or reputation.
IT leadership initially reviews these incidents, and this information is shared with our Cyber Disclosure Committee, as required.
−Removed: The Cyber Disclosure Committee is comprised of the Company's VP & General Counsel, the CISO, and the VP, CAO & Treasurer.
+Added: The Cyber Disclosure Committee is comprised of the Company's VP & General Counsel, the CISO, and the VP, Interim CFO & Treasurer.
The process requires that any incidents deemed to be potentially material under the Incident Response Plan are immediately escalated in accordance with the Plan to the CEO, other senior leaders of the organization, the Audit Committee Chair, and the full Board as appropriate to formalize the materiality assessment and apprise them of the situation.
We utilize a variety of methods performed both internally and by third parties to assess the Company's cyber risk management program including penetration tests, risk assessments and evaluation against the NIST CSF.
−Removed: The effectiveness of controls and safeguards are evaluated on an on-going basis to address current and emerging cyber-risks.
+Added: The effectiveness of controls and safeguards are evaluated on an ongoing basis to address current and emerging cyber-risks.
We engage an external auditor to conduct an annual Payment Card Industry Data Security Standard review of our security controls protecting payment information.
8 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.