4 unchanged sentences
The Company has developed and implemented a cybersecurity program designed to manage these threats, including the assessment, identification and management of cybersecurity risks, and related protection, response, mitigation and recovery efforts.
−Removed: The program is overseen and monitored by a dedicated internal global cybersecurity organization, led by the Company’s Chief Information Security Officer (“CISO”), who reports directly to the Company’s Chief Technology Officer (“CTO”), and supported by designated cybersecurity risk leaders at the Company’s business units.
+Added: The program is overseen and monitored by a dedicated internal global cybersecurity organization, led by the Company’s Chief Information Security Officer (“CISO”), who reports directly to the Company’s Chief Technology Officer (“CTO”), and supported by designated business information security officers at the Company’s business units.
The Company’s cybersecurity program is informed in part by the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework and leverages a defense-in-depth approach to managing cybersecurity risk .
The governance, principles and framework for the program are set forth in the Company’s Global Cybersecurity Governance Principles Framework and are complemented by a set of global cybersecurity policies designed to promote secure cyber and data practices among Company personnel.
−Removed: T he Company reinforces a culture of secure behavior through annual cybersecurity and privacy awareness trainings, quarterly phishing exercises and regular delivery of other security awareness content via newsletters, departmental meetings and periodic campaigns, as well as specialized secure development training for product development teams.
−Removed: In addition, the Company employs various technical measures and processes to address the cybersecurity threats it faces, which may include reporting, monitoring and alert tools, multi-factor authentication, encryption, endpoint detection and response, email and cloud security tools, vulnerability scanning tools, threat intelligence monitoring and application resilience measures, as well as threat modeling, architecture design reviews and code reviews performed by its product security team.
+Added: T he Company reinforces a culture of secure behavior through annual cybersecurity and privacy awareness trainings, quarterly phishing exercises and regular delivery of other security awareness content via an online training system, steering committees, newsletters, departmental meetings and periodic campaigns, as well as specialized secure development training for product development teams.
+Added: In addition, the Company employs various technical measures and processes to address the cybersecurity threats it faces, which may include reporting, monitoring and alert tools, identity and access management, multi-factor authentication, encryption, endpoint detection and response, email, application and cloud security tools, vulnerability scanning tools, threat intelligence monitoring and application resilience measures, as well as threat modeling, architecture design reviews and code reviews performed by its product security team.
The Company maintains a cybersecurity incident response policy and plan, which in conjunction with the above measures, are designed to facilitate detection, analysis, containment, remediation and recovery from cybersecurity incidents and set forth processes to manage, escalate and, as appropriate, report such incidents based on their potential impact to the Company.
1 unchanged sentence
The Company conducts periodic testing and assessments of its cybersecurity program, both through internal security personnel and third-party firms.
−Removed: The Company engages consultants and other independent third parties to periodically perform internal and external penetration testing, security audits, incident response readiness exercises and assessments of the Company’s cybersecurity risk management practices, including a maturity assessment of the Company’s cybersecurity program based on the NIST Cybersecurity Framework approximately every two years.
+Added: The Company engages consultants and other independent third parties to periodically perform internal and external penetration testing, security audits, incident response readiness exercises and assessments of the Company’s cybersecurity risk management practices, including an evaluation of the Company’s cybersecurity program based on the NIST Cybersecurity Framework approximately every two years.
The Company may also consult with external legal counsel, third-party experts and other advisors in connection with incident response and recovery efforts and forensic investigations.
9 unchanged sentences
To date, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.
−Removed: However, the Company continues to face cybersecurity risks such
−Removed: as those described in “Item 1A.
+Added: However, the Company continues to face cybersecurity risks such as those described in “Item 1A.
Risk Factors” in this Annual Report on Form 10-K, and there can be no assurance that cybersecurity threats or incidents will not have a material adverse effect on the Company in the future.
2 unchanged sentences
The Board of Directors has delegated to the Audit Committee primary responsibility for overseeing risks related to cybersecurity, including reviewing with management the Company’s major cyber-related risk exposures and the steps that have been taken to monitor and control such exposures.
−Removed: The Audit Committee generally receives reports at least quarterly from the CTO and CISO on the Company’s cybersecurity program covering various topics, including incident reporting, a review of the global cyber risk-map, updates on NIST maturity assessments, employee training and technology solutions and other practices designed to minimize the risks associated with cybersecurity threats, and updates the Board of Directors as appropriate.
+Added: The Audit Committee generally receives reports at least quarterly from the CTO and CISO on the Company’s cybersecurity program covering various topics, including incident reporting, a review of the global cyber risk-map, updates on the cybersecurity program and initiatives, employee training, technology solutions and other practices designed to minimize the risks associated with cybersecurity threats, and updates the Board of Directors as appropriate.
Management is responsible for identifying, assessing and managing material cybersecurity risks on a day-to-day basis.
1 unchanged sentence
The Company’s global cybersecurity organization, led by the CISO, is responsible for developing and implementing cybersecurity policies and procedures and identifying potential risks across the Company and works closely with dedicated cybersecurity personnel at the Company’s business units.
−Removed: The Company’s CTO has been in his senior leadership role since 2020.
−Removed: He has held similar positions prior to joining News Corp, has over 30 years of experience in various cybersecurity and information technology infrastructure and risk management roles and holds an advanced degree in information systems.
−Removed: The Company’s CISO has been in his senior leadership role since 2021 and has over two decades of industry experience in cybersecurity and other technology-related roles, including as the Director of Cyber and Telecom Policy in the White House, where he advised senior administration officials on cybersecurity, technology and telecommunications policy issues.
+Added: The Company’s CTO assumed his position in June 2025 after serving in various leadership and technology roles at the Company’s subsidiary News Corp Australia since 2012, including as CTO from 2020.
+Added: He has extensive experience in information technology infrastructure and risk management, digital media and the management of digital networks.
+Added: The Company’s CISO has been in his position since December 2024 after serving in various leadership and information security roles at the Company since 2021.
+Added: He has over two decades of industry experience in cybersecurity, information governance and risk management at large media and technology companies.
As part of the Company’s cybersecurity program, described above, the CISO is informed about and monitors the Company’s prevention, detection, response, mitigation and remediation efforts related to cybersecurity threats through regular communication and reporting from the Company’s cybersecurity team.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.