4 unchanged sentences
The Company has developed and implemented a cybersecurity program designed to manage these threats, including the assessment, identification and management of cybersecurity risks, and related protection, response, mitigation and recovery efforts.
−Removed: The program is overseen and monitored by a dedicated internal global cybersecurity organization, led by the Company’s Chief Information Security Officer (“CISO”), who reports directly to the Company’s Chief Technology Officer (“CTO”), and supported by designated business information security officers at the Company’s business units.
+Added: The program is overseen and monitored by its Cybersecurity Office, a dedicated internal global cybersecurity organization led by the Company’s Chief Information Security Officer (“CISO”), who reports directly to the Company’s Chief Technology Officer (“CTO”).
+Added: The Cybersecurity Office also includes designated Business Information Security Officers at the Company’s business units.
The Company’s cybersecurity program is informed in part by the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework and leverages a defense-in-depth approach to managing cybersecurity risk .
The governance, principles and framework for the program are set forth in the Company’s Global Cybersecurity Governance Principles Framework and are complemented by a set of global cybersecurity policies designed to promote secure cyber and data practices among Company personnel.
−Removed: T he Company reinforces a culture of secure behavior through annual cybersecurity and privacy awareness trainings, quarterly phishing exercises and regular delivery of other security awareness content via an online training system, steering committees, newsletters, departmental meetings and periodic campaigns, as well as specialized secure development training for product development teams.
−Removed: In addition, the Company employs various technical measures and processes to address the cybersecurity threats it faces, which may include reporting, monitoring and alert tools, identity and access management, multi-factor authentication, encryption, endpoint detection and response, email, application and cloud security tools, vulnerability scanning tools, threat intelligence monitoring and application resilience measures, as well as threat modeling, architecture design reviews and code reviews performed by its product security team.
−Removed: The Company maintains a cybersecurity incident response policy and plan, which in conjunction with the above measures, are designed to facilitate detection, analysis, containment, remediation and recovery from cybersecurity incidents and set forth processes to manage, escalate and, as appropriate, report such incidents based on their potential impact to the Company.
−Removed: The Company also undertakes disaster recovery and business continuity planning and maintains certain system redundancies to limit the impact of cybersecurity incidents and other disruptions, but there can be no assurance that these efforts will be successful.
+Added: T he Company reinforces a culture of secure behavior through annual cybersecurity and privacy awareness training, quarterly phishing exercises and regular delivery of other security awareness content via an online training system, steering committees, newsletters, departmental meetings and periodic campaigns, as well as specialized secure development training for product development teams.
+Added: In addition, the Company employs various technical measures and processes to address the cybersecurity threats it faces, which may include reporting, monitoring and alert tools, identity and access management, multi-factor authentication, data and network encryption, endpoint detection and response, email, application and cloud security tools, vulnerability scanning tools, threat intelligence monitoring and application resilience measures, as well as threat modeling, architecture design reviews and code reviews performed by its product security team.
+Added: The Company maintains a cybersecurity incident response policy, plan and standard, which in conjunction with the above measures, are designed to facilitate detection, analysis, containment, remediation and recovery from cybersecurity incidents and set forth processes to manage, escalate and, as appropriate, report such incidents based on their potential impact to the Company.
+Added: The Company also undertakes disaster recovery and business continuity planning and maintains certain system redundancies to limit the impact of cybersecurity and other events, but there can be no assurance that these efforts will be successful.
The Company conducts periodic testing and assessments of its cybersecurity program, both through internal security personnel and third-party firms.
−Removed: The Company engages consultants and other independent third parties to periodically perform internal and external penetration testing, security audits, incident response readiness exercises and assessments of the Company’s cybersecurity risk management practices, including an evaluation of the Company’s cybersecurity program based on the NIST Cybersecurity Framework approximately every two years.
+Added: The Company engages consultants and other independent third parties to periodically perform internal and external penetration testing, security audits, incident response readiness exercises and assessments of the Company’s cybersecurity risk management practices, including an evaluation of the Company’s cybersecurity program maturity based on the NIST Cybersecurity Framework approximately every three years.
The Company may also consult with external legal counsel, third-party experts and other advisors in connection with incident response and recovery efforts and forensic investigations.
8 unchanged sentences
Although the Company dedicates significant resources and efforts to protect against cybersecurity risks, the Company has experienced, and expects to continue to be subject to, cybersecurity threats.
−Removed: To date, the Company is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.
+Added: To date, the Company has not determined that any cybersecurity incident has materially affected or is reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.
However, the Company continues to face cybersecurity risks such as those described in “Item 1A.
−Removed: Risk Factors” in this Annual Report on Form 10-K, and there can be no assurance that cybersecurity threats or incidents will not have a material adverse effect on the Company in the future.
+Added: Risk Factors” in this Annual Report on Form 10-K, and there can be no assurance that cybersecurity threats or incidents will not have a material adverse effect on the Company.
While the Company maintains cyber risk insurance, such insurance may not be sufficient to cover all losses from cybersecurity incidents.
1 unchanged sentence
The Board of Directors has delegated to the Audit Committee primary responsibility for overseeing risks related to cybersecurity, including reviewing with management the Company’s major cyber-related risk exposures and the steps that have been taken to monitor and control such exposures.
−Removed: The Audit Committee generally receives reports at least quarterly from the CTO and CISO on the Company’s cybersecurity program covering various topics, including incident reporting, a review of the global cyber risk-map, updates on the cybersecurity program and initiatives, employee training, technology solutions and other practices designed to minimize the risks associated with cybersecurity threats, and updates the Board of Directors as appropriate.
+Added: The Audit Committee generally receives reports at least quarterly from the CTO and CISO on the Company’s cybersecurity program covering various topics, including the overall cybersecurity environment, a review of the threat landscape and key cyber risks, incident reporting and updates on the cybersecurity program and initiatives designed to minimize the risks associated with cybersecurity threats, and updates the Board of Directors as appropriate.
Management is responsible for identifying, assessing and managing material cybersecurity risks on a day-to-day basis.
The Company’s Global Cybersecurity Steering Committee, comprised of the CTO, CISO and representatives from internal audit, legal, finance, privacy and human resources, is responsible for overseeing the Company’s cybersecurity controls and generally meets on a quarterly basis.
−Removed: The Company’s global cybersecurity organization, led by the CISO, is responsible for developing and implementing cybersecurity policies and procedures and identifying potential risks across the Company and works closely with dedicated cybersecurity personnel at the Company’s business units.
+Added: The Company’s Cybersecurity Office, led by the CISO, is responsible for developing and implementing cybersecurity policies and procedures and identifying potential risks across the Company and includes dedicated cybersecurity personnel at the Company’s business units.
The Company’s CTO assumed his position in June 2025 after serving in various leadership and technology roles at the Company’s subsidiary News Corp Australia since 2012, including as CTO from 2020.
5 unchanged sentences
The CISO provides regular updates to the CTO and the Global Cybersecurity Steering Committee and to other members of executive management, as appropriate.
−Removed: The Company’s reporting framework also includes its incident response policy and plan and other policies and processes which set forth specific procedures for internal and external reporting in the event of a cybersecurity incident, including notification to the Audit Committee or the Board of Directors, as appropriate.
+Added: The Company’s reporting framework also includes its incident response policy, plan and standard and other policies and processes which set forth specific procedures for internal and external reporting in the event of a cybersecurity incident, including notification to the Audit Committee or the Board of Directors, as appropriate.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.