1 unchanged sentence
CYBERSECURITY
−Removed: The Company maintains a cybersecurity program that is aligned with its business and has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which have been integrated into its overall risk management processes and governance structure.
−Removed: The Company has implemented and invested in, and will continue to implement and invest in, controls, technologies, and resources (both internal and external) that are designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology.
+Added: Cybersecurity continues to be a key governance priority for us.
+Added: NACCO maintains a cybersecurity program that is aligned with our business and has established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, which have been integrated into our overall risk management processes and governance structure.
+Added: We have implemented and invested in, and will continue to implement and invest in, controls, technologies, and resources (both internal and external) that are designed to identify, protect against, detect, respond to and mitigate cybersecurity risks, in alignment with frameworks established by the National Institute of Standards and Technology.
These include, but are not limited to, internal reporting mechanisms, monitoring and detection tools, threat intelligence, and general and role-based training.
−Removed: The Company also maintains third party management processes to identify and manage the cybersecurity risks
−Removed: associated with third party service providers.
−Removed: The Company periodically evaluates its cybersecurity program internally and by engaging with consultants to conduct reviews and assessments of the program.
+Added: NACCO's commitment to cybersecurity emphasizes cultivating a security-minded culture through education and training that reflect best practices and improved cybersecurity awareness.
+Added: We also maintain third party management processes to identify and manage the cybersecurity risks associated with third party service providers.
+Added: We periodically evaluate our cybersecurity program internally and by engaging with consultants to conduct reviews and assessments of the program.
Such reviews and assessments may include penetration testing, maturity assessments as well as table-top and other exercises with subsequent remediation of key findings.
−Removed: Additionally, the Company has a Cybersecurity Task Force in place that is comprised of individuals across various departments within the organization including information systems, legal, finance, human resources and internal audit which meets regularly to further advance the Company’s cybersecurity strategy.
−Removed: The Board of Directors (the “Board”) oversees NACCO's risk management.
−Removed: The full Board regularly reviews information provided by management to oversee risk identification, risk management and risk mitigation strategies.
+Added: Additionally, we have a Cybersecurity Task Force in place that is comprised of individuals across various departments within our organization including information systems, legal, finance, human resources and internal audit which meets regularly to further advance our cybersecurity strategy.
+Added: Our Board of Directors (Board) oversees NACCO's risk management.
+Added: Our full Board regularly reviews information provided by management to oversee risk identification, risk management and risk mitigation strategies.
The Audit Review Committee assists the Board with cybersecurity risk oversight.
−Removed: The Audit Review Committee is responsible for regularly reviewing and discussing with management risk exposure relating to cybersecurity, which includes reviewing the state of the Company's cybersecurity program and emerging cybersecurity developments and threats, as well as the steps management has taken to monitor and mitigate such exposure.
−Removed: In 2023, the Board and the Audit Review Committee received periodic updates throughout the year on cybersecurity matters and these updates are part of their standing agendas.
−Removed: The Company’s Chief Information Security Officer ("CISO") leads the Company’s cybersecurity program and is responsible for the management of its cybersecurity risks.
+Added: The Audit Review Committee is responsible for regularly reviewing and discussing with management risk exposure relating to cybersecurity, which includes reviewing the state of our cybersecurity program and emerging cybersecurity developments and threats, as well as the steps management has taken to monitor and mitigate such exposure.
+Added: In 2024, our Board and the Audit Review Committee received periodic updates throughout the year on cybersecurity matters and these updates are part of their standing agendas.
+Added: Our Chief Information Security Officer (CISO) leads NACCO's cybersecurity program and is responsible for the management of our cybersecurity risks.
The CISO has extensive cybersecurity knowledge and skills gained from over 30 years of technical and business experience, including as General Manager & President of MLMC, Vice President of Mississippi Operations and Vice President of Innovation & Technology.
The CISO holds a bachelor’s degree in engineering, an executive MBA, and certifications in cybersecurity from Harvard.
−Removed: Additionally, the CISO is currently enrolled in an Executive course through Northwestern’s Kellogg School of Management focused on artificial intelligence (“AI”).
+Added: Additionally, the CISO successfully completed an Executive course through Northwestern’s Kellogg School of Management focused on artificial intelligence during 2024.
The CISO reports directly to the President and Chief Executive Officer.
1 unchanged sentence
The CISO is informed of cybersecurity incidents by the cybersecurity team, which is generally responsible for monitoring the prevention, detection, mitigation, and remediation of cybersecurity incidents.
−Removed: The Company has an established process governing its assessment, response and internal and external notifications upon the occurrence of a cybersecurity incident, including evaluation of the potential impacts of cybersecurity incidents to determine materiality.
−Removed: Depending on the nature and severity of an incident, this process provides for escalation procedures upon discovery of material cybersecurity risks, including notification to the Company’s executive management and/or Board.
−Removed: As of the date of this filing, the Company’s business strategy, results of operations, and financial condition have not been materially impacted as a result of any previously identified cybersecurity incidents;
−Removed: however, we cannot provide assurance that they will not be materially impacted in the future by such risks or any future material incidents.
−Removed: For additional information regarding the Company’s cybersecurity risks, please refer to "Item 1A - “Risk Factors” on page 19.
+Added: We have an established process governing our assessment, response and internal and external notifications upon the occurrence of a cybersecurity incident, including evaluation of the potential impacts of cybersecurity incidents to determine materiality.
+Added: Depending on the nature and severity of an incident, this process provides for escalation procedures upon discovery of material cybersecurity risks, including notification to our executive management and/or Board.
+Added: As of the date of this filing, our business strategy, results of operations, and financial condition have not been materially impacted as a result of any previously identified cybersecurity incidents;
+Added: however, NACCO cannot provide assurance that we will not be materially impacted in the future by such risks or any future material incidents.
+Added: For additional information regarding our cybersecurity risks, please refer to Item 1A - Risk Factors on page 18.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.