2 unchanged sentences
CYBERSECURITY RISK MANAGEMENT AND STRATEGY
−Removed: We use a multi-layered defensive cybersecurity strategy based on the cyber security framework drafted by the NIST.
−Removed: The NIST CSF is a voluntary framework of best practices to identify, protect, detect, respond to, and recover from cybersecurity matters.
+Added: We use a multi-layered defensive cybersecurity strategy based on the cyber security framework drafted by the U.S.
+Added: Department of Commerce's National Institute of Standards and Technology (NIST).
+Added: The NIST Cybersecurity Framework (NIST CSF) is a voluntary framework of best practices to identify, protect, detect, respond to, and recover from cybersecurity matters.
Based on the NIST CSF, our processes to identify, assess, and manage material risks from cybersecurity threats includes the following:
4 unchanged sentences
We mitigate risks from cybersecurity threats by applying multiple layers of defense to ensure we have the continued ability to access or utilize an asset or its value, and deny threat actors the ability to gain or increase their access to an asset or its value.
−Removed: We prioritize defensive mechanisms, including administrative,
−Removed: procedural, and technical controls, according to their relative cost and reduction in risk based on the NIST CSF.
+Added: We prioritize defensive mechanisms, including administrative, procedural, and technical controls, according to their relative cost and reduction in risk based on the NIST CSF.
We further monitor, test, assess, and update these processes, including working with government agencies and peers to implement practices to guard against an evolving threat environment and to ensure we remain compliant with relevant regulatory requirements.
Integration into our Risk Management Framework
−Removed: Our processes to assess, identify, and manage cybersecurity risks are expressly incorporated into our enterprise risk management (ERM) framework, which includes technology as one of the five primary risk categories addressed by the ERM framework, with cybersecurity risks being one of the three subcategories within the technology risk category.
−Removed: As a result, our ERM leadership team works with the Chief Information Officer (CIO) and Chief Information Security Officer (CISO) to define the top areas of risk in both the technology and cybersecurity areas, with such risks incorporated into our ERM framework and mapped to the NIST CSF.
−Removed: Our internal ERM leadership also meets on a quarterly basis with our technology risk working group, comprised of leaders across the information technology, information security and law departments, to monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.
+Added: Our processes to assess, identify, and manage cybersecurity risks are expressly incorporated into our enterprise risk management (ERM) framework.
+Added: Technology is one of the five primary risk categories addressed by the ERM framework, and cybersecurity is identified as a subcategory of the technology risk.
+Added: Our ERM leadership team works with the Chief Information and Digital Officer (CIDO), the Senior Director of Information Security (SDIS) and other technology leaders to identify, define, and assess top areas of technology and cybersecurity risks, which are included in our ERM risk framework and mapped to the NIST CSF.
+Added: Our internal ERM leadership meets regularly with our technology leadership team to review developments in our technology risk profile and works with the cybersecurity team to monitor key risk indicators linked to our cybersecurity risks.
+Added: Any changes to the threat landscape are discussed and considered as adjustments to our risk profile.
Third-Party Engagement
3 unchanged sentences
Within our purchasing and third-party vendor management programs, we require all vendors who handle our data as well as vendors who provide technology and data services – including hardware, software, staffing, and support – to maintain certain security protections including, but not limited to, compliance with applicable data protection laws and implementation of administrative, physical, and technical safeguards to protect our data, including how our data is stored, accessed, and transmitted.
−Removed: In addition, all providers within these service categories must sign our data security attachment that articulates the specific security standards, cybersecurity insurance, and mandatory incident reporting protocols applicable to the underlying provision of services.
+Added: In addition, all providers within these service categories must execute a data security addendum that articulates specific security standards, cybersecurity insurance, and mandatory incident reporting protocols applicable to the underlying provision of services.
Please see Item 1A.
−Removed: Risk Factors – Operational Risks – “A significant cybersecurity incident or other disruption to our technology infrastructure could disrupt our business operations” for our disclosures regarding the most pertinent risks we may experience from cybersecurity threats.
+Added: Risk Factors – Technology Risks – “A significant cybersecurity incident or other disruption to our technology infrastructure resulting from internal and external threats could disrupt our business operations” for our disclosures regarding the most pertinent risks we may experience from cybersecurity threats.
As noted therein, regardless of the cause, a significant disruption or failure of one or more information or operational technology systems operated by us or under control of third parties can result in service disruptions, unauthorized access to our systems, viruses, ransomware, and/or compromise, acquisition, or destruction of our data.
−Removed: Such a direct or indirect cybersecurity incident could interrupt our service, cause safety failures or operational difficulties, decrease revenues, increase operating costs, impact our efficiency, damage our corporate reputation, and/or expose us to litigation, government action, increased regulation, penalties, fines or judgments, any or all
−Removed: which may ultimately have a materially adverse effect on our results of operations, financial condition, reputation, and business (including our strategy of operating a resilient freight railroad).
+Added: Such a direct or indirect cybersecurity incident could interrupt our service, cause safety failures or operational difficulties, decrease revenues, increase operating costs, impact our efficiency, damage our corporate reputation, and/or expose us to litigation, government action, increased regulation, penalties, fines or judgments, any or all which may ultimately have a materially adverse effect on our results of operations, financial condition, reputation, and business (including our strategy of operating a resilient freight railroad).
While we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation, or financial results.
2 unchanged sentences
Board Oversight
−Removed: The Norfolk Southern Board, through the F&RM Committee, has direct oversight of cybersecurity risks.
−Removed: The F&RM Committee receives periodic reports from the CIO and CISO regarding the primary technology risks impacting the company, including risks impacting our information and operational systems, service resiliency, cybersecurity risks, and the related threat environment.
+Added: The Norfolk Southern Board, both directly itself and indirectly through the F&RM Committee, has oversight of cybersecurity risks.
+Added: The F&RM Committee receives periodic reports from the CIDO regarding the primary technology risks impacting the company, including risks impacting our information and operational systems, service resiliency, cybersecurity risks, and the related threat environment.
Agendas for these periodic updates may be further adjusted to address any emerging risks or key topics in greater detail, including emerging regulations, best practices, cyber readiness, and third-party assessment results.
Regular updates are also provided to the F&RM Committee regarding all material or potentially material cybersecurity incidents, including root causes, and identification of and progress towards, remediation activities through completion.
−Removed: The Board receives a periodic update from the Chair of the F&RM Committee regarding the matters addressed by the F&RM Committee, as well as an annual report from the CISO highlighting the emerging threat landscape, our progress executing on our defensive cybersecurity strategy, and a review of our cybersecurity incident investigation and response processes.
+Added: The Board receives a periodic update from the Chair of the F&RM Committee regarding the matters addressed by the F&RM Committee, as well as an annual report from the CIDO highlighting the emerging threat landscape, our progress executing on our defensive cybersecurity strategy, and a review of our cybersecurity incident investigation and response processes.
Management's Role
−Removed: The CISO, reporting to the CIO, is directly responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance.
−Removed: Our CISO has significant relevant experience in the area, including graduate and postgraduate engineering technology degrees, along with 20 years of information security experience in critical infrastructure, as well as seven years with Norfolk Southern where he guided the Company through the implementation of our multi-layered defensive cybersecurity strategy that aligns with the NIST CSF.
−Removed: As noted above, our technology risk working group, comprised of leaders across the information technology, information security and law departments, including our CIO, CISO and Data Privacy Officer (DPO), among others, further monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.
+Added: Our SDIS, reporting to the CIDO, is directly responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance.
+Added: Such individual has significant relevant experience in the area, including over 27 years of technology experience in various industries with 17 years focused on information security, as well as significant experience working closely with government agencies including the Federal Bureau of Investigation, the Transportation Security Agency, and the Department of Homeland Security.
+Added: As noted above, our technology risk working group, comprised of leaders across the information technology, information security, and law departments, including our CIDO, SDIS, and Data Privacy Officer (DPO), among others, further monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.
Management and Board Reporting
−Removed: Cybersecurity incidents are reported directly to the CISO in accordance with the applicable incident response plan.
−Removed: The CISO, together with the DPO, determine incident severity and response, and in turn report material or potentially material incidents to our internal 8-K subcommittee (comprised of senior leaders from the law, accounting, finance, investor relations, and communications departments), our CEO, and our Executive Vice President Corporate Affairs and Chief Legal Officer, who in turn notify the Chairs of the Board and the F&RM Committee.
+Added: Cybersecurity incidents are reported directly to the SDIS in accordance with the applicable incident response plan.
+Added: The SDIS, together with the DPO, determine incident severity and response, and in turn report material or potentially material incidents to our internal 8-K subcommittee (comprised of senior leaders from the law, accounting, finance, investor relations, and communications departments), our CEO, and our Chief Legal Officer, who in turn notify the Chairs of the Board and the F&RM Committee.
The Board is promptly notified prior to filing any 8-K disclosing any material or potentially material cybersecurity incidents, with the F&RM Committee provided further updates regarding root causes and remediation efforts.
−Removed: We also have a cybersecurity incident response plan including specific responsive protocols administered by a predesignated incident response team, led by our CISO and DPO and comprised of other members of management.
+Added: We also have a cybersecurity incident response plan including specific responsive protocols administered by a predesignated incident response team, led by the SDIS and DPO and comprised of other members of management.
This incident response team also conducts periodic table-top exercises with management to ensure adherence to our cybersecurity incident response plan.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.