17 unchanged sentences
We have adopted an Incident Response Policy, which outlines the procedures we believe are necessary to identify, investigate, contain, communicate, respond, remediate and recover from a security incident.
−Removed: This Incident Response Policy is overseen by our Vice President of Infrastructure and Security (“VP Infrastructure”) along with the Incident Response team, which may consist of members from legal, human resources, finance or other functions, if necessary.
+Added: This Incident Response Policy is overseen by our Chief Information Officer (“CIO”) along with the Incident Response team, which may consist of members from legal, human resources, finance or other functions, if necessary.
The Incident Response Policy provides organizational and operational structure, processes, and procedures to our personnel so employees can respond to incidents that may affect the function and security of our IT assets, information resources, and business operations.
5 unchanged sentences
Our Audit Committee of the Board of Directors is responsible for oversight of risks from cybersecurity threats.
−Removed: Our Audit Committee receives quarterly reports from our Enterprise Risk Management Committee (“ERM Committee”), as well as directly from our Chief Information Officer (“CIO”) or VP Infrastructure, periodically, as appropriate.
+Added: Our Audit Committee receives quarterly reports from our Enterprise Risk Management Committee (“ERM Committee”), as well as directly from our CIO, periodically, as appropriate.
These reports cover various cybersecurity matters, including risk assessments, risk prevention and mitigation activities, and incident reports along with remediating actions, areas of emerging risks, industry trends, and other areas of importance.
1 unchanged sentence
This assessment encompasses key risks associated with security, technology, and cybersecurity threats in the same manner as other key risks.
−Removed: Our cybersecurity risk management processes are led by our CIO and our VP Infrastructure .
+Added: Our cybersecurity risk management processes are led by our CIO .
Our CIO has served our company in that capacity since 2018 and held CIO or other IT and cybersecurity leadership roles at other companies for more than 10 years prior to that.
He has a master’s degree in computer systems from the Naval Postgraduate School.
−Removed: Our VP Infrastructure, who is responsible for our information technology infrastructure and our information security strategy and operations, has more than 30 years of experience in information technology, serving in senior IT leadership roles with responsibility for cybersecurity at our company since 2007.
−Removed: His IT expertise was established prior to that through education and work experience in a variety of technical positions in the consumer goods, health care, and aerospace industries.
−Removed: They are supported by a team of skilled information security professionals within our Information Technology function.
+Added: He is supported by a team of skilled information security professionals within our Information Technology function.
This team provides periodic updates to our ERM Committee, composed of our Chief Executive Officer, Chief Financial Officer, General Counsel, and other members of our senior leadership.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.