6 unchanged sentences
The SOC is a team comprised of cybersecurity professionals who are responsible for real-time incident response management for our IT infrastructure, which includes our websites, applications, databases, servers, network devices and components and workstations.
−Removed: They are trained and equipped to identify, contain, analyze and investigate any perceived security threats as well as assist internal users with any information security questions or reported issues, such as phishing/scam emails, information security concerns and security solution related access or performance issues.
+Added: They are trained and equipped to identify, contain, analyze and investigate any perceived security threats, as well as assist internal users with any
+Added: information security questions or reported issues, such as phishing/scam emails, information security concerns and security solution related access or performance issues.
As part of our cybersecurity program, team members are offered cybersecurity training and participate in awareness programs including phishing simulation exercises, regular cybersecurity newsletters and reminders and programming and events during cybersecurity awareness month.
1 unchanged sentence
In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers .
−Removed: We generally require that third-party service providers that access, host our data, or could otherwise introduce cybersecurity risk to us, enter into contracts that obligate them to manage their cybersecurity risks in certain ways and report any cybersecurity incidents to us.
+Added: We generally require that third-party service providers that access or host our data, or could otherwise introduce cybersecurity risk to us, enter into contracts that obligate them to manage their cybersecurity risks in certain ways and report any cybersecurity incidents to us.
We engage third-party advisory firms to conduct assessments of the maturity of our security program and, among other measures, work to be Payment Card Industry compliant where required.
2 unchanged sentences
The Technology, Environmental, Safety and Security Committee of our Board of Directors oversees our programs and policies related to data protection and cybersecurity and receives updates on related risks from our Chief Information Security Officer on at least an annual basis, and more often as the circumstances require.
−Removed: The Audit Committee of our Board of Directors also receives updates, at least annually, from our Chief Information Officer and/or Chief Information Security Officer regarding cybersecurity and other information system compliance matters that may pose risks to our financial reporting or operations.
+Added: The Audit Committee of our Board of Directors also receives updates, at least annually, from our Chief Technology Officer and/or Chief Information Security Officer regarding cybersecurity and other information system compliance matters that may pose risks to our financial reporting or operations.
Our Chief Information Security Officer is responsible for our overall data security and cybersecurity risk reduction efforts, including information security compliance, training and awareness and application, network and system security.
−Removed: Our Chief Information Security Officer has 25 years of prior experience in the fields of information systems, cybersecurity, risk management, and infrastructure management.
+Added: Our Chief Information Security Officer has over 25 years of prior experience in the fields of information systems, cybersecurity, risk management, and infrastructure management.
Our Chief Information Security Officer holds master’s and bachelor’s degrees in both Computer Information Systems and Business Administration and the following certifications:
−Removed: Certified Internal Controls Auditor (CICA), Payment Card Industry Professional (PCIP), Certified
−Removed: Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC).
+Added: Certified Internal Controls Auditor (CICA), Payment Card Industry Professional (PCIP), Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA) and Certified in Risk and Information Systems Control (CRISC).
We discuss risks related to cybersecurity threats under the heading “Breaches in data security or other disturbances to our information systems and other networks or our actual or perceived failure to comply with requirements regarding data privacy and protection could impair our operations, subject us to significant fines, penalties and damages, and have a material adverse impact on our business, financial condition and results of operations” included as part of our risk factor disclosures in Item 1A of this Annual Report, which disclosures are incorporated by reference herein.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.