2 unchanged sentences
We are subject to numerous cybersecurity threats which could result in equipment or network failures, loss of information (including sensitive personal information of customers or employees or proprietary information) as well as disruptions to our or our customers’, suppliers’ or vendors’ operations.
−Removed: Cybersecurity risks we face include threats from entities and persons that may seek to target our information technology (“IT”) infrastructure or use malware, computer viruses, denial of services attacks, ransomware attacks, credential harvesting, social engineering and other means to obtain unauthorized access to or disrupt the operation of our networks, systems and those of our suppliers, vendors and other service providers.
−Removed: In addition, we may face cyber threats from parties that seek to target us through our customers, suppliers, and other stakeholders with whom we do business.
+Added: Cybersecurity risks we face include threats from entities and persons that may seek to target our information technology (“IT”) or operational technology (“OT”) infrastructures or use malware, computer viruses, denial of services attacks, ransomware attacks, credential harvesting, social engineering and other means to obtain unauthorized access to or disrupt the operation of our networks, systems and those of our suppliers, vendors and other service providers.
+Added: In addition, we may face cyber threats from parties that seek to target us through our customers, suppliers, vendors and other stakeholders with whom we do business.
Cybersecurity threats are constantly evolving and becoming increasingly sophisticated and complex, increasing the difficulty of detecting and successfully defending against them.
1 unchanged sentence
We strive to follow the guidelines set by the National Institute of Standards and Technology Cybersecurity Framework to manage information assets, protect sensitive data and mitigate security risks.
−Removed: To address risks from cybersecurity threats, we maintain an information security team, automated monitoring and detection services, and policies and procedures for managing risk to our information systems.
+Added: To address risks from cybersecurity threats, we
+Added: maintain an information security team, automated monitoring and detection services, and policies and procedures for managing risks to our information systems.
As part of our information security program, our operations strive to assess, identify and manage cybersecurity threat risks by:
8 unchanged sentences
Management is responsible for assessing, identifying, and managing risks from cybersecurity threats.
−Removed: Our Board is responsible for risk oversight and utilizes an enterprise risk management process to assist in fulfilling its oversight
−Removed: responsibilities.
+Added: Our Board is responsible for risk oversight and monitors an enterprise risk management process prepared by management to assist in fulfilling its oversight responsibilities.
The Board has delegated responsibility for overseeing the monitoring and assessment of risks related to cybersecurity to the Audit Committee.
5 unchanged sentences
Our Chief Information Officer is responsible for timely informing management regarding cybersecurity incidents, including prevention, detection, mitigation, and remediation activities.
−Removed: Our Chief Information Officer and Director of Cybersecurity communicate at least annually with the Board on matters such as data protection and cybersecurity.
−Removed: We maintain cybersecurity incident response plans, which address defined actions to be taken in response to cyber incidents.
−Removed: In the event of a material cybersecurity incident, the Chief Information Officer must notify both management and the Board.
+Added: Our Chief Information Officer and Director of Cybersecurity communicate at least annually with the Audit Committee and the Board on matters such as data protection and cybersecurity.
+Added: These individuals have extensive cybersecurity knowledge and skills, with over 15 years of collective experience in the management of cybersecurity threats.
+Added: We maintain cybersecurity incident response plans, which address defined actions to be taken in response to risks from cyber incidents.
+Added: In the event of a material cybersecurity incident, the Chief Information Officer must notify management, the Audit Committee and the Board.
Impact of Risks from Cybersecurity Threats
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.