5 unchanged sentences
The NIST Cybersecurity Framework (NIST CSF) is a voluntary framework of best practices to identify, protect, detect, respond to, and recover from cybersecurity matters.
−Removed: Based on the NIST CSF, our processes to identify, assess, and manage material risks from cybersecurity threats includes the following:
+Added: Based on the NIST CSF, our processes to identify, assess, manage, and govern material risks from cybersecurity threats includes the following:
We identify risks from cybersecurity threats by first developing and maintaining an understanding of those assets essential to our operation and reputation, as well as assets that could provide value to threat actors.
4 unchanged sentences
We prioritize defensive mechanisms, including administrative, procedural, and technical controls, according to their relative cost and reduction in risk based on the NIST CSF.
+Added: We govern cybersecurity risk by establishing and maintaining the policies, processes, and oversight mechanisms that define how risk is identified, assessed, and managed across the enterprise.
+Added: Governance ensures that roles, responsibilities, and decision-making authority are clearly articulated and aligned with organizational objectives, regulatory requirements, and risk appetite.
+Added: Through governance, we embed accountability and transparency into our cybersecurity program, enabling informed prioritization of resources and consistent execution of risk management practices.
We further monitor, test, assess, and update these processes, including working with government agencies and peers to implement practices to guard against an evolving threat environment and to ensure we remain compliant with relevant regulatory requirements.
2 unchanged sentences
Technology is one of the five primary risk categories addressed by the ERM framework, and cybersecurity is identified as a subcategory of the technology risk.
−Removed: Our ERM leadership team works with the Chief Information and Digital Officer (CIDO), the Senior Director of Information Security (SDIS) and other technology leaders to identify, define, and assess top areas of technology and cybersecurity risks, which are included in our ERM risk framework and mapped to the NIST CSF.
+Added: Our ERM leadership team works with the Chief Information and Digital Officer (CIDO), the Chief Information Security Officer (CISO), and other technology leaders to identify, define, and assess top areas of technology and cybersecurity risks, which are included in our ERM risk framework and mapped to the NIST CSF.
Our internal ERM leadership meets regularly with our technology leadership team to review developments in our technology risk profile and works with the cybersecurity team to monitor key risk indicators linked to our cybersecurity risks.
1 unchanged sentence
Third-Party Engagement
−Removed: We employ multiple service providers from time to time to perform periodic reviews and evaluations of our cybersecurity framework, the results of which are provided to and reviewed with management, with appropriate reporting to the Finance and Risk Management Committee (F&RM Committee) of the Board.
+Added: We employ multiple service providers from time to time to perform periodic reviews and evaluations of our cybersecurity framework, the results of which are provided to and reviewed with management, with appropriate reporting to the Board.
These reviews encompass a broad range of areas, including information technology system resilience, cybersecurity risk assessments, information security program assessments, external threat environment reviews, internal cybersecurity policy compliance, and near-term incident response to identify or disconfirm potential involvement of a threat actor.
7 unchanged sentences
While we have previously experienced technology outages and cybersecurity events that have impacted our systems and service, future events may result in more significant impacts to our operations, reputation, or financial results.
−Removed: As a result of these prior events, and given the potential risks that a technology outage or cybersecurity event would result in a materially adverse effect on our results of operations, financial condition, reputation, or business, we have conducted and will continue conducting, internal and third-party assessments of information technology and cybersecurity vulnerabilities, information technology resiliency, and our related processes and procedures, so that we can continue to identify and address key cybersecurity risks.
+Added: As a result of these prior events, and given the potential risks that a technology outage or cybersecurity event would result in a materially adverse effect on our results of operations, financial condition, reputation, or business, we have conducted and will continue conducting, internal and third-party assessments of information technology and
+Added: cybersecurity vulnerabilities, information technology resiliency, and our related processes and procedures, so that we can continue to identify and address key cybersecurity risks.
CYBERSECURITY GOVERNANCE
Board Oversight
−Removed: The Norfolk Southern Board, both directly itself and indirectly through the F&RM Committee, has oversight of cybersecurity risks.
−Removed: The F&RM Committee receives periodic reports from the CIDO regarding the primary technology risks impacting the company, including risks impacting our information and operational systems, service resiliency, cybersecurity risks, and the related threat environment.
+Added: The Norfolk Southern Board has direct oversight of cybersecurity risks.
+Added: The Board receives periodic reports from the CIDO and CISO regarding the primary technology risks impacting the company, including risks impacting our information and operational systems, service resiliency, cybersecurity risks, and the related threat environment.
Agendas for these periodic updates may be further adjusted to address any emerging risks or key topics in greater detail, including emerging regulations, best practices, cyber readiness, and third-party assessment results.
−Removed: Regular updates are also provided to the F&RM Committee regarding all material or potentially material cybersecurity incidents, including root causes, and identification of and progress towards, remediation activities through completion.
−Removed: The Board receives a periodic update from the Chair of the F&RM Committee regarding the matters addressed by the F&RM Committee, as well as an annual report from the CIDO highlighting the emerging threat landscape, our progress executing on our defensive cybersecurity strategy, and a review of our cybersecurity incident investigation and response processes.
+Added: Regular updates are also provided to the Board regarding all material or potentially material cybersecurity incidents, including root causes, and identification of and progress towards, remediation activities through completion.
+Added: The Board receives an annual report from the CIDO and CISO highlighting the emerging threat landscape, our progress executing on our defensive cybersecurity strategy, and a review of our cybersecurity incident investigation and response processes.
Management's Role
−Removed: Our SDIS, reporting to the CIDO, is directly responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance.
−Removed: Such individual has significant relevant experience in the area, including over 27 years of technology experience in various industries with 17 years focused on information security, as well as significant experience working closely with government agencies including the Federal Bureau of Investigation, the Transportation Security Agency, and the Department of Homeland Security.
−Removed: As noted above, our technology risk working group, comprised of leaders across the information technology, information security, and law departments, including our CIDO, SDIS, and Data Privacy Officer (DPO), among others, further monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.
+Added: Our CISO, reporting to the CIDO, is directly responsible for the assessment, oversight, and management of our enterprise-wide cybersecurity strategy and governance.
+Added: Such individual has over 20 years of experience in critical infrastructure security, including significant experience working with government agencies such as the Federal Bureau of Investigation, the Transportation Security Agency, and the Department of Homeland Security.
+Added: As noted above, our technology risk working group, comprised of leaders across the information technology, information security, and law departments, including our CIDO, CISO, and Data Privacy Officer (DPO), among others, further monitor developments in the threat landscape so that key cybersecurity threats impacting the Company continue to be identified and prioritized.
Management and Board Reporting
−Removed: Cybersecurity incidents are reported directly to the SDIS in accordance with the applicable incident response plan.
−Removed: The SDIS, together with the DPO, determine incident severity and response, and in turn report material or potentially material incidents to our internal 8-K subcommittee (comprised of senior leaders from the law, accounting, finance, investor relations, and communications departments), our CEO, and our Chief Legal Officer, who in turn notify the Chairs of the Board and the F&RM Committee.
−Removed: The Board is promptly notified prior to filing any 8-K disclosing any material or potentially material cybersecurity incidents, with the F&RM Committee provided further updates regarding root causes and remediation efforts.
−Removed: We also have a cybersecurity incident response plan including specific responsive protocols administered by a predesignated incident response team, led by the SDIS and DPO and comprised of other members of management.
+Added: Cybersecurity incidents are reported directly to the CISO in accordance with the applicable incident response plan.
+Added: The CISO, together with the DPO, determine incident severity and response, and in turn report material or potentially material incidents to our internal 8-K subcommittee (comprised of senior leaders from the law, accounting, finance, investor relations, and communications departments), our Chief Executive Officer (CEO), and our Chief Legal Officer, who in turn notify the Chair of the Board.
+Added: The Board is promptly notified prior to filing any 8-K disclosing any material or potentially material cybersecurity incidents, with the CIDO and CISO providing the Board with further updates regarding root causes and remediation efforts.
+Added: We also have a cybersecurity incident response plan including specific responsive protocols administered by a predesignated incident response team, led by the CISO and DPO and comprised of other members of management.
This incident response team also conducts periodic table-top exercises with management to ensure adherence to our cybersecurity incident response plan.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.