3 unchanged sentences
We recognize the importance of safeguarding the security of our computer systems, software, networks, and other technology assets.
−Removed: Our security efforts are aimed at preserving the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cyber threat landscape.
+Added: Our cybersecurity efforts are aimed at preserving the confidentiality, integrity, and continued availability of information under our ownership or care with the aim to continually improve security features in order to keep pace with the evolving cyber threat landscape.
Overview of Cybersecurity Risk Management and Strategy
2 unchanged sentences
Our ISMS is informed by ISO/IEC 27001:2022 standards and is operated based on an action model that identifies information security missions and objectives, including improvement measures to achieve continuous optimization.
−Removed: Our Cybersecurity Incident Response Plan (“CIRP”) is a critical component of our cybersecurity risk identification and management process, which, along with our incident response team, is designed to guide our response to potential cybersecurity incidents effectively and efficiently.
−Removed: Our ISM Policy, ISMS and CIRP are all internal tools we use to assess, identify and manage material risks from cybersecurity threats.
+Added: Our Cybersecurity Incident Response Plan (“CIRP”) is a critical component of our cybersecurity incident identification and management process, which, along with our incident response team, is designed to guide our response to potential cybersecurity incidents effectively and efficiently.
+Added: Our ISM Policy, ISMS and CIRP are all internal processes we use to assess, identify and manage material risks from cybersecurity threats.
We also utilize external partnerships to help protect the Company from cybersecurity threats.
1 unchanged sentence
We have controls in place to defend against risks associated with cyber-attacks impacting our operations, compliance and financial reporting objectives.
−Removed: We are externally audited and certified under the ISO 27001 and assessed according to National Institute of Standards and Technology (“NIST”) guidelines.
+Added: We are externally audited and certified under the ISO 27001 and assessed yearly according to National Institute of Standards and Technology (“NIST”) guidelines.
Our external partners also evaluate our cybersecurity maturity and coverage as part of their services and keep us informed of emerging global threats.
4 unchanged sentences
This framework includes processes for conducting, as appropriate, due diligence, risk assessment and planning, contract management, access control, ongoing monitoring, and possible service termination of, or changes to the third-party as part of the selection and management process.
−Removed: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, like other companies, we and our third-party vendors have on occasion experienced, and will continue to experience, threats to our or their data and systems.
+Added: We have implemented a Threat Intelligence function that informs of external cyber threats which allows us to proactively protect the Company and to allow us to improve the speed of our vulnerability management capabilities.
+Added: Cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition.
+Added: Similar to other companies, we and our third-party vendors have and will continue to experience threats to our systems and data.
Board Oversight of Risks from Cybersecurity Threats
2 unchanged sentences
We routinely review critical elements of our cybersecurity policies and program with the Audit Committee.
−Removed: The management team – including our Senior Director, Global Information Security – provides periodic reports to the Audit Committee which cover cybersecurity and other information technology risks affecting the Company.
+Added: The management team – including our Chief Information Security Officer (“CISO”) – provides periodic reports to the Audit Committee which cover cybersecurity and other information technology risks affecting the Company.
Such reports are typically provided at an Audit Committee meeting and enable Audit Committee members to ask questions of management and engage in additional discussions in an open forum.
2 unchanged sentences
Our Information Security Steering Committee (“ISSC”) is responsible for oversight of matters related to information security and currently consists of professionals in legal operations and risk management, information governance, human resources operations, internal audit, computerized systems, global security and technical operations, and research technology, all whose input bring significant value when assessing and managing cybersecurity risk.
−Removed: Our ISSC meets periodically and is presented with an update on cybersecurity matters from our Senior Director, Global Information Security.
−Removed: Our Senior Director, Global Information Security is responsible for facilitating the implementation of the plans and decisions made by the ISSC and directly provides updates to the Audit Committee as detailed above.
−Removed: Our Senior Director, Global Information Security and our Vice President of Global Technology Solutions head our Global Technology Solutions Team which is responsible for leading the individuals tasked with maintaining our enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes.
−Removed: Our Senior Director of Global Information Security has over eighteen years of information technology and cybersecurity experience in multiple industries, including building and leading governance, risk, and compliance functions that cover ISO 27001 certified compliance, NIST Cybersecurity Framework assessments, Sarbanes-Oxley (“SOX”) information technology compliance, regional compliances, policy management, information technology risk management, vendor risk management, and security awareness.
+Added: Our ISSC meets periodically and is presented with an update on cybersecurity matters from our CISO.
+Added: Our CISO is responsible for facilitating the implementation of the plans and decisions made by the ISSC and directly provides updates to the Audit Committee as detailed above.
+Added: Our Vice President of Global Technology Solutions head our Global Technology Solutions Team along with our CISO are responsible for leading the individuals tasked with maintaining our enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes.
+Added: Our CISO has over eighteen years of information technology and cybersecurity experience in multiple industries, including building and leading governance, risk, and compliance functions that cover ISO 27001 certified compliance, NIST Cybersecurity Framework assessments, Sarbanes-Oxley (“SOX”) information technology compliance, regional compliances, policy management, information technology risk management, vendor risk management, and security awareness.
Our Vice President of Global Technology Solutions has over twenty years of experience leading technology organization and managing information security across multiple industries, including SOX 404 compliance, GxP audit and compliance, NIST Cybersecurity Framework assessments, managing incident response and communication with executives and board of directors .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.