1 unchanged sentence
Not applicable.
−Removed: T able of Contents
CYBERSECURITY
−Removed: Risk Management and Strategy - We are an essential critical infrastructure business, and cybersecurity is a high priority for our leadership and Board of Directors.
−Removed: In 2021, the Transportation Security Administration (TSA) began releasing security directives establishing cybersecurity requirements for our industry.
−Removed: We promptly responded to these directives when released and continue to work collaboratively with our government counterparts to improve security throughout our technology systems.
−Removed: We engage in an annual comprehensive Enterprise Risk Management (ERM) process designed to identify and manage risk.
−Removed: Our annual ERM assessment is designed to enable our Board of Directors to establish a mutual understanding with management of the effectiveness of our risk-management practices and capabilities, to review our risk exposures and to elevate certain key risks for discussion at the board level.
+Added: Risk Management and Strategy - We take a cross-disciplinary approach to cybersecurity and physical security.
+Added: Our annual Enterprise Risk Management (ERM) process encompasses the identification and assessment of a broad range of risks, including cybersecurity, and the development and testing of controls to mitigate these risks.
+Added: Our ERM assessment is designed to enable our Board of Directors to establish a mutual understanding with management of the effectiveness of our risk-management practices and capabilities, to review our risk exposures and to elevate certain key risks for discussion at the board level.
Our ERM program is overseen by our chief financial officer.
−Removed: Our ERM process encompasses the identification and assessment of a broad range of risks, including cybersecurity, and the development and testing of controls to mitigate these risks.
−Removed: In order to manage these cybersecurity risks, including our use of third-party software and cloud vendors, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information.
−Removed: We take a cross-disciplinary approach to cybersecurity and physical security.
Our cybersecurity risk management program is integrated with our ERM program and shares common methodologies, reporting channels and governance processes that apply across the ERM program to other legal compliance, strategic, operational and financial risk areas.
−Removed: Our program generally incorporates the guidelines of the widely utilized National Institute of Standards and Technology Cybersecurity Framework, though this does not imply we meet any particular technical standards, specifications or requirements.
−Removed: In addition, we conduct risk assessments of third-party software and cloud vendors by utilizing security questionnaires prior to procurement.
−Removed: On a regular basis, we engage consultants to conduct penetration tests and architecture design reviews.
−Removed: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.
+Added: Our security program generally incorporates the guidelines of the widely utilized National Institute of Standards and Technology Cybersecurity Framework, though this does not imply we meet any particular technical standards, specifications or requirements.
+Added: In addition, we conduct risk assessments of enterprise third-party software and cloud vendors by utilizing security questionnaires prior to procurement.
+Added: On a regular basis, we engage consultants, including external counsel and cybersecurity firms, to conduct penetration tests and architecture design reviews.
+Added: As of the date of this report, though the Company and third parties have experienced certain non-material cybersecurity incidents, we are not aware of any cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.
We face certain ongoing risks from cybersecurity threats that, if realized and material, may materially affect us, including our operations, business strategy, results of operations or financial condition.
See Part 1, Item 1A “Risk Factors” for a discussion of risks factors related to cybersecurity.
−Removed: Governance - Security is governed by the Security Advisory team, an executive advisory committee composed of company officers, including our chief executive officer, our chief financial officer and our chief enterprise services officer, who meet regularly to evaluate ongoing security threats and incidents, to define policy and to prioritize initiatives.
−Removed: This advisory team is chaired by our vice president of cybersecurity and physical security, who has more than twenty years of relevant experience in the field of cyber and physical security.
−Removed: In his role, our vice president of cybersecurity and physical security also supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, alerts and reports produced by security tools deployed in our technology infrastructure and threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers.
+Added: Governance - Security is governed by the Security Advisory team, an executive advisory committee composed of company officers, including our chief executive officer, our chief financial officer and our chief enterprise services officer.
+Added: The Security Advisory team meets regularly to evaluate ongoing security threats and incidents, to define policy and to prioritize initiatives.
Identified cybersecurity threats and incidents are monitored and assessed for materiality by this cross-functional Security Advisory Team.
This assessment includes whether our Board of Directors should be informed of a threat or incident.
+Added: The Security Advisory team is chaired by our vice president of cybersecurity and physical security who has more than twenty years of relevant experience in the field of cyber and physical security.
+Added: In his role, our vice president of cybersecurity and physical security also supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, alerts and reports produced by security tools deployed in our technology infrastructure and threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers.
+Added: Our vice president of cybersecurity and physical security reports to our executive vice president and chief enterprise services officer, responsible for cybersecurity, information technology, enterprise optimization and innovation, among other responsibilities.
+Added: Before joining ONEOK, our executive vice president and chief enterprise services officer held information technology positions of increasing responsibility.
Cybersecurity risks are communicated and discussed with our Board of Directors at least annually in conjunction with our overall ERM program.
+Added: Internal Audit provides periodic updates to the Audit Committee on testing completed to meet TSA requirements.
As part of its oversight responsibilities, our Board of Directors also receives frequent updates from executive management on our company’s physical and cybersecurity efforts.
2 unchanged sentences
We have elected to use a $1 million threshold for disclosing environmental proceedings.
−Removed: Information about our legal proceedings is included in Note O of the Notes to Consolidated Financial Statements in this Annual Report.
+Added: Information about our legal proceedings is included in Note P of the Notes to Consolidated Financial Statements in this Annual Report.
MINE SAFETY DISCLOSURES
Not applicable.
−Removed: T able of Contents
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.