5 unchanged sentences
This program is integrated into our enterprise risk management (ERM) framework, and the underlying controls leverage recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework.
−Removed: Our Company’s Chief Information Officer (CIO) is responsible for developing and maintaining our global cybersecurity and information technology program and directs our Information Security team.
−Removed: The Information Security team is primarily responsible for identifying and protecting against cybersecurity threats and maintains a comprehensive set of policies and standards applicable to our global organization.
+Added: The Information Technology organization is led by the Company’s Chief Information Officer (CIO), who is responsible for cybersecurity and risk management, with oversight by the Audit Committee.
+Added: The cybersecurity program is overseen by the Company’s Chief Information Security Officer (CISO) and supporting cybersecurity leadership, who lead teams to protect and preserve the confidentiality, integrity and continued availability of all information owned by, or in the care of, Olin against cybersecurity threats and maintains a comprehensive set of policies and standards applicable to our global organization.
+Added: The CIO and CISO, along with the leadership team, possess many years of relevant Information Technology, cybersecurity and risk management experience in the manufacturing and defense sectors with Olin or other large public companies.
+Added: Educational backgrounds include advanced degrees and certifications, such as Certified Information Systems Security Professional.
We consult with multiple third-party firms to assess and review these policies and standards and regularly update them for contemporary best practices.
−Removed: Our CIO has over fifteen years of experience leading cybersecurity oversight for global organizations, and our Information Security team leaders have extensive cybersecurity and information technology industry experience with Olin or other large public companies and hold industry certifications, including the Certified Information Systems Security Professional certification.
Our Information Security team monitors alerts and meets to discuss threat levels, trends and remediation tactics.
1 unchanged sentence
Significant events are evaluated for both quantitative and qualitative factors to determine materiality on a case-by-case basis, including, among other factors, potential privacy, operational, financial, or reputational impacts for the Company, and our customers, vendors, shareholders, or other external stakeholders.
−Removed: The Information Security team prepares a monthly scorecard for senior management, summarizing cyber events for the month and reporting on our remedial actions.
−Removed: While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition.
+Added: The Information Security team prepares a quarterly scorecard for senior management and the Audit Committee, summarizing cyber activity for the quarter and reporting on our remedial actions.
+Added: While we have experienced typical cybersecurity incidents, such incidents to date have not materially affected the Company or our business strategy, results of operations, or financial condition.
The Company regularly conducts penetration testing, both internally and by third parties, and conducts automated attacks simulating real-world cyber incidents.
These tests and assessments are useful tools for maintaining a comprehensive cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property.
−Removed: We continue to expand our cybersecurity risk mitigation strategies, which includes around-the-clock monitoring of our global network, using layered defenses and identifying and protecting critical assets, including our manufacturing facilities.
+Added: We continue to expand our cybersecurity risk mitigation strategies, which includes around-the-clock monitoring of our global network, using
+Added: layered defenses and identifying and protecting critical assets, including our manufacturing facilities.
The Information Security team conducts annual cybersecurity awareness training and quarterly email phishing tests and training for all employees.
7 unchanged sentences
Cybersecurity Governance
−Removed: Cybersecurity is an important component of our ERM framework and an area of focus for both our Board of Directors (Board) and management team.
−Removed: While management holds primary responsibility for our Company’s risk management strategy,
−Removed: our Board, with the support of its committees, oversees the process to ensure that the framework designed, implemented and maintained by management is functioning as intended and adapts, when necessary, to our evolving strategy and emerging risks.
−Removed: The Board’s Audit Committee is delegated responsibility for oversight of our ERM process, including our strategies to identify, detect and respond to cybersecurity and information technology risks and threats.
+Added: Cybersecurity is an important component of our ERM framework and an area of focus for both our Board of Directors and management team.
+Added: While management holds primary responsibility for our Company’s risk management strategy, our Board of Directors, with the support of its committees, oversees the process to ensure that the framework designed, implemented and maintained by management is functioning as intended and adapts, when necessary, to our evolving strategy and emerging risks.
+Added: The Board of Director’s Audit Committee is delegated responsibility for oversight of our ERM process, including our strategies to identify, detect and respond to cybersecurity and information technology risks and threats.
Our Audit Committee’s process includes an annual review of our ERM program to ensure appropriate practices are in place to monitor and mitigate identified risks on an ongoing basis.
−Removed: Additionally, our CIO meets with the Audit Committee or Board each quarter to discuss cyber hygiene, incidents (as needed), and provide updates on our enterprise-wide cybersecurity risks and strategies, including steps taken to mitigate and manage the same.
−Removed: To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on current cyber topics, trends and best practices.
−Removed: We have established protocols by which certain cybersecurity incidents are reported to the Audit Committee and Board.
+Added: Additionally, our CIO meets with the Audit Committee or Board of Directors each quarter to discuss cyber hygiene, incidents (as needed), and provide updates on our enterprise-wide cybersecurity risks and strategies, including steps taken to mitigate and manage the same.
+Added: To aid the Board of Directors with its cybersecurity and data privacy oversight responsibilities, the Board of Directors periodically hosts experts for presentations on current cyber topics, trends and best practices.
+Added: In the event that a cybersecurity incident is determined to have, or is likely to have, a material impact on the Company, the CIO, in coordination with Olin’s Chief Financial Officer, Chief Legal Officer or Chief Executive Officer will notify the Audit Committee and Board of Directors, following the Company’s Crisis Management Plan and Procedures.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.