7 unchanged sentences
The systems and partnerships described above are all potential targets for a cyber-incident.
−Removed: Any significant interruption or failure of our information systems due to cyber-attacks, hacking or internal security breaches could prevent us from fulfilling our critical business functions including delivering energy to our customers, and sensitive, confidential, and other data could be compromised.
+Added: Any significant interruption or failure of our information systems due to cyber-attacks or incidents could hinder our ability to fulfill our critical business functions.
This could adversely affect our business, our financial condition, operating results or liquidity.
−Removed: For the year ended December 31, 2023, there have been no cybersecurity incidents with a material impact on our business strategy, operations, or financial condition.
+Added: Through the year ending on December 31, 2024, there have been no cybersecurity incidents that have had a material impact, or any impact, on our business strategy, operations, or financial condition.
Risk Management and Strategy
5 unchanged sentences
Our cybersecurity processes, including our threat detection, monitoring, and response protocols are subject to ongoing vulnerability testing, and comparison to industry practices.
−Removed: An Incident Response and Disaster Recovery Plan is maintained and periodically exercised.
+Added: An Incident Response and Disaster Recovery Plan is maintained and exercised.
The plan includes a process to identify, protect, detect, respond to and recover from cybersecurity threats and incidents.
1 unchanged sentence
This includes a clearly defined escalation process within the plan to ensure management and the Board of Directors are notified if an incident or series of events warrant escalation.
−Removed: Our strategy includes employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, modern end point protection against threats, patching strategy, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing.
−Removed: We monitor potential risks associated with the use of third-party service providers and vendors.
−Removed: Our cyber incident monitoring process includes dialog with any third party or business partner potentially impacted by a disclosed incident.
+Added: Our strategy includes employee training and awareness on cybersecurity risks and related best practices, simulated phishing campaigns, required password complexity, the use of multi-factor authentication, information security protocols, modern end point protection against threats, patching strategy, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing.
+Added: As part of engaging a new third party provider, we assess their security standards, require security terms and conditions and work with risk management to ensure insurance coverage is adequate for the exposure risk.
Service providers and vendors must adhere to security requirements such as security incident or data breach notification and response protocols, appropriate data encryption requirements, and data disposal.
−Removed: In addition, we engage with third party consultants to perform penetration (PEN) studies.
+Added: Our cyber incident monitoring process includes dialog with any third party or business partner potentially impacted by a disclosed incident.
+Added: In addition, we leverage third party consultants to perform penetration (PEN) studies.
These independent third party assessments provide valuable insight to enhance our cybersecurity posture.
8 unchanged sentences
The Vice President - Technology is responsible for informing the Chief Executive Officer and other Officers, as necessary, about cybersecurity incidents, covering prevention, detection, mitigation, and remediation efforts as they are detected by the cyber security team.
−Removed: Collectively, our cyber security team has experience in cybersecurity, hold numerous industry certifications related to cybersecurity, and have experience in desktop support, networking, application administration and programming.
+Added: Collectively, our cyber security team holds numerous industry certifications related to cybersecurity and have experience in desktop support, networking, application administration and programming.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.