6 unchanged sentences
Our cybersecurity risk identification, assessment and management process is a critical part of our overall enterprise risk management (“ERM”) system.
−Removed: Within our ERM system, we adhere to our Information Security Management Policy (“ISM Policy”) which is aimed at providing guidelines to monitor, review and continually improve our Information Security Management System (“ISMS”).
+Added: Within our ERM program, we adhere to our Information Security Management System Policy (“ISMS Policy”) which is aimed at providing guidelines to monitor, review and continually improve our Information Security Management System (“ISMS”).
Our ISMS is informed by ISO/IEC 27001:2022 standards and is operated based on an action model that identifies information security missions and objectives, including improvement measures to achieve continuous optimization.
Our Cybersecurity Incident Response Plan (“CIRP”) is a critical component of our cybersecurity incident identification and management process, which, along with our incident response team, is designed to guide our response to potential cybersecurity incidents effectively and efficiently.
−Removed: Our ISM Policy, ISMS and CIRP are all internal processes we use to assess, identify and manage material risks from cybersecurity threats.
+Added: Our ISMS Policy, ISMS and CIRP are all internal processes we use to assess, identify and manage material risks from cybersecurity threats.
We also utilize external partnerships to help protect the Company from cybersecurity threats.
1 unchanged sentence
We have controls in place to defend against risks associated with cyber-attacks impacting our operations, compliance and financial reporting objectives.
−Removed: We are externally audited and certified under the ISO 27001 and assessed yearly according to National Institute of Standards and Technology (“NIST”) guidelines.
+Added: We are externally audited and certified under ISO 27001:2022 and additionally assessed yearly according to National Institute of Standards and Technology (“NIST”) guidelines.
Our external partners also evaluate our cybersecurity maturity and coverage as part of their services and keep us informed of emerging global threats.
5 unchanged sentences
We have implemented a Threat Intelligence function that informs of external cyber threats which allows us to proactively protect the Company and to allow us to improve the speed of our vulnerability management capabilities.
−Removed: Cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition.
+Added: To date, cybersecurity threats have not materially affected us, our business strategy, results of operations or financial condition.
Similar to other companies, we and our third-party vendors have and will continue to experience threats to our systems and data.
3 unchanged sentences
We routinely review critical elements of our cybersecurity policies and program with the Audit Committee.
−Removed: The management team – including our Chief Information Security Officer (“CISO”) – provides periodic reports to the Audit Committee which cover cybersecurity and other information technology risks affecting the Company.
+Added: The management team – including our Chief Information Security Officer (“CISO”) – provides reports on a quarterly basis to the Audit Committee which cover cybersecurity and other information technology risks affecting the Company.
Such reports are typically provided at an Audit Committee meeting and enable Audit Committee members to ask questions of management and engage in additional discussions in an open forum.
4 unchanged sentences
Our CISO is responsible for facilitating the implementation of the plans and decisions made by the ISSC and directly provides updates to the Audit Committee as detailed above.
−Removed: Our Vice President of Global Technology Solutions head our Global Technology Solutions Team along with our CISO are responsible for leading the individuals tasked with maintaining our enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes.
+Added: Our Chief Technology Officer (“CTO”), along with our CISO, is responsible for leading the individuals tasked with maintaining our enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes.
+Added: Our CTO has over thirty years of experience leading technology organizations and managing information security across multiple industries and programs, including SOX 404 compliance, GxP audit and compliance, NIST Cybersecurity Framework assessments, managing incident response and communication with executives and board of directors.
Our CISO has over eighteen years of information technology and cybersecurity experience in multiple industries, including building and leading governance, risk, and compliance functions that cover ISO 27001 certified compliance, NIST Cybersecurity Framework assessments, Sarbanes-Oxley (“SOX”) information technology compliance, regional compliances, policy management, information technology risk management, vendor risk management, and security awareness.
−Removed: Our Vice President of Global Technology Solutions has over twenty years of experience leading technology organization and managing information security across multiple industries, including SOX 404 compliance, GxP audit and compliance, NIST Cybersecurity Framework assessments, managing incident response and communication with executives and board of directors .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.