2 unchanged sentences
Risk Management and Strategy
−Removed: As a leader in Information Management and cybersecurity we recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats.
+Added: We recognize the importance of assessing, identifying, and managing risks associated with cybersecurity threats.
These risks include, among other things, operational risks;
intellectual property theft;
−Removed: harm to employees or customers;
+Added: harm to employees or clients;
violation of privacy or security laws and other litigation and legal risk;
and reputational risks.
−Removed: At OpenText, cybersecurity risk management is an integral part of our overall enterprise risk management program.
+Added: Cybersecurity risk management is integrated into our enterprise risk management processes and is designed to enable the identification, assessment, monitoring, and mitigation of cybersecurity risks that could affect our business operations, clients, products, services, and technology infrastructure.
Our cybersecurity risk management program aligns with industry best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 and the International Organization for Standardization (ISO)/International Electro-technical Commission (IEC) ISO/IEC 27001 standard.
−Removed: This provides a framework for identifying, monitoring, evaluating, and responding to cybersecurity threats and incidents, including those associated with the use of our software, applications, services, and cloud and hybrid infrastructures developed or provided by third-party vendors and service providers.
+Added: This provides a framework for identifying, monitoring, evaluating, and
+Added: responding to cybersecurity threats and incidents, including those associated with the use of our software, applications, services, and cloud and hybrid infrastructures developed or provided by third-party vendors and service providers.
Our framework includes steps for identifying the source of a cybersecurity threat or incident, assessing the severity and risk of a cybersecurity threat or incident, implementing cybersecurity mitigation or remediation strategies, and informing our management and our Board of material cybersecurity threats and incidents.
OpenText has a cross-functional incident response team, led by our cybersecurity team and comprised of representatives from our information technology, cybersecurity, finance, and legal teams.
−Removed: The cybersecurity team primarily is responsible for the monitoring and assessment of potential cybersecurity occurrences such as data breaches, intrusions, and other security incidents and implementing our detailed incident response plan.
−Removed: Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of the Company and our customers information assets.
+Added: The cybersecurity team is primarily responsible for overseeing the cybersecurity risk management program and incident response processes, in coordination with other business functions.
+Added: Our incident response plan includes processes and procedures for assessing potential internal and external threats, activation and notification, crisis management, and post-incident recovery designed to safeguard the confidentiality, availability, and integrity of the Company and our clients’ information assets.
+Added: Our incident response and risk management processes include procedures for evaluating the materiality of cybersecurity incidents and determining appropriate escalation, reporting and disclosure obligations.
Our cybersecurity team is responsible for assessing our cybersecurity risk management program and our incident response plan.
−Removed: We have devoted significant financial and personnel resources to implement security measures to meet regulatory requirements and customer expectations, and we intend to continue to make investments to maintain the security of the Company and its customers data and Information Management infrastructure.
−Removed: We have also implemented a review process to assess the security profile and data protection practices of third-party service providers that have exposure to our systems.
+Added: We have devoted significant financial and personnel resources to implement security measures to meet regulatory requirements and client expectations, and we intend to continue to make investments to maintain the security of the Company and its clients’ data and data management infrastructure.
+Added: We maintain processes to assess cybersecurity and data protection risks associated with third-party vendors and service providers that have access to our systems, data or technology infrastructure.
+Added: These assessments are incorporated into our broader third-party risk management activities .
We review and update our cybersecurity policies, standards and procedures annually, or more frequently as needed, to account for changes in the threat landscape, as well as in response to legal and regulatory developments.
Our internal audit department has a team responsible for IT and information security (including cybersecurity) audits.
−Removed: We also engage third-party cybersecurity consultants to conduct additional audits of our cybersecurity processes, provide assessments of our risk management programs and identify potential cybersecurity vulnerabilities.
+Added: We engage independent third-party cybersecurity firms to perform assessments, penetration testing, program reviews and other evaluations designed to identify potential cybersecurity risks and areas for improvement.
Our cybersecurity efforts also include mandatory training for all employees and contractors on OpenText’s security and privacy policies as well as other ancillary trainings on topics such as phishing emails and other social engineering tactics.
−Removed: Tab le of C ontents
In Fiscal 2026, we did not identify any cybersecurity threats or incidents or risks of such incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.
4 unchanged sentences
For more information, see Part III, Item 11, “Board’s Role in Risk Oversight.”
−Removed: Our current Chief Information Security Officer (CISO) has over 20 years of experience architecting and directing global information security functions and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties.
−Removed: Our CISO is responsible for day-to-day risk management activities, including identifying and assessing cybersecurity risks, establishing processes in an effort to ensure that potential cybersecurity risk exposures are monitored, implementing appropriate mitigation or remediation measures and maintaining cybersecurity programs.
−Removed: Our CISO receives ongoing communication from relevant teams related to cybersecurity and is responsible for providing a single consolidated view of the Company’s enterprise cybersecurity risk in various industries.
−Removed: OpenText’s CISO reports to the Chief Digital Officer (CDO) who is responsible for OpenText’s broader IT program, which includes the Company’s ability to remediate and recover from a cybersecurity incident while minimizing impacts to the business and operations.
−Removed: Management, including the CDO, updates the Audit Committee and the Board of Directors on the Company’s cybersecurity programs, material cybersecurity risks, and mitigation or remediation strategies as needed or appropriate.
+Added: Our Chief Information Security Officer (CISO) leads the Company’s cybersecurity program and has more than 20 years of experience managing and directing global information security functions and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties.
+Added: The CISO is responsible for overseeing cybersecurity strategy, risk assessment, incident response, security operations, and cybersecurity governance activities.
+Added: The CISO receives regular information regarding cybersecurity threats, vulnerabilities, incidents, and risk mitigation efforts and provides management with reporting regarding the Company's cybersecurity risk posture.
+Added: The CISO reports to the Chief Digital Officer (CDO), who is responsible for the Company's broader information technology strategy and operations, including capabilities related to cybersecurity resilience, incident response, and business recovery.
+Added: Management, including the CISO and CDO, periodically reports to the Audit Committee and the Board of Directors regarding cybersecurity risks, significant incidents, emerging threats, mitigation activities, and the overall effectiveness of the Company's cybersecurity program.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.