4 unchanged sentences
To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threats alongside other company risks as part of our overall risk assessment process.
−Removed: In addition, we perform an external, specific cybersecurity risk assessment every eighteen months.
−Removed: Included in our management of cybersecurity risk is our bi-annual review of our Incident Response Plan/Policy, involving employees from all responsibility levels of the company.
+Added: In addition, we perform an external, specific cybersecurity risk assessment every eighteen months to assess and identify risks.
+Added: Included in our management of cybersecurity risk is our annual review of our Incident Response Plan/Policy, involving employees from all responsibility levels of the company.
Our Chief Financial Officer has primary responsibility for overseeing our information systems and information technology resources, including risks from cybersecurity threats.
−Removed: To assist our Chief Financial Officer in discharging these responsibilities, we have a standing management committee to address information technology and cybersecurity risk matters comprised of our Chief Financial Officer, the principal of a third-party, managed security service provider (an “MSSP”), our Vice President of Risk Management, our Chief Accounting Officer, our Senior Vice President of Human Resources and certain other members of our information technology staff and property management.
+Added: To assist our Chief Financial Officer in discharging these responsibilities, we have a standing management committee to address information technology and cybersecurity risk matters comprised of our Chief Financial Officer, our Chief Executive Officer, our Director of IT, our Senior Vice President of Risk Management, a virtual Chief Information Security Officer (a "vCISO") with our managed security service provider (an “MSSP”), and certain other members of our information technology staff.
The members of this committee meet on a quarterly basis, with additional full or sub-committee meetings held as-needed throughout the year, to:
7 unchanged sentences
• require training and security awareness programs for our employees.
−Removed: Our Vice President of Risk Management monitors and tests these initiatives on a periodic basis.
+Added: Our Senior Vice President of Risk Management monitors and tests these initiatives on a periodic basis.
Additionally, our Chief Financial Officer partners with the MSSP and our information technology staff throughout the organization to manage material risks from cybersecurity threats, as well as to provide managerial and operational support for our information systems and information technology resources on a daily basis.
−Removed: Index to Financial Statements
We also maintain an Incident Response Plan/Policy to coordinate the actions we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.
−Removed: The Incident Response Plan/Policy is tested with tabletop exercises to assess the validity of the plan and to make necessary modifications, as needed, on a bi-annual basis.
+Added: The Incident Response Plan/Policy is tested with tabletop exercises to assess the validity of the plan and to make necessary modifications, as needed, on an annual basis.
We utilize a third party Security Information and Event Management ("SIEM") service to collect, analyze, and correlate security logs and events from various sources across the Piedmont corporate and property networks to detect and respond to cyber threats in real-time.
2 unchanged sentences
We utilize external risk advisory and accounting firms to perform an audit focusing on entity-level, application and information technology general computer controls annually, as well as the full cybersecurity risk assessment mentioned above.
−Removed: Audit results and the risk assessments are reviewed by our Chief Financial Officer, the principal of the MSSP, and our Vice President of Risk Management.
+Added: Audit results
+Added: Index to Financial Statements
+Added: and the risk assessments are reviewed by our Chief Financial Officer, our Director of IT, the vCISO, and our Senior Vice President of Risk Management.
Any exceptions are addressed with a remediation plan and implemented with appropriate resources.
5 unchanged sentences
We also have a cybersecurity awareness training program which includes annual required online training, periodic updates, notices, and reminders, and bi-weekly simulated phishing attacks with required remedial training for failures.
−Removed: Further, we have a documented business continuity plan that is updated and tested on an annual basis and we carry an information security risk insurance policy.
+Added: Further, we have a documented business continuity plan that is updated and tested annually and we carry an information security risk insurance policy.
See "We face risks related to the occurrence of cyber incidents, or a deficiency in our cybersecurity, which could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results” included as part of the risk factors described in Item 1A of this Annual Report on Form 10-K for additional information on the potential impact any cybersecurity incident may have on our business, results of operations, financial condition and cash flows.
Cybersecurity Governance
−Removed: The Audit Committee of the board of directors oversees cybersecurity risk and is comprised of three independent members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.
+Added: The Audit Committee of the board of directors oversees cybersecurity risk and is comprised of four independent members with diverse expertise including, risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.
The chair of our Audit Committee holds a Certificate in Cybersecurity Oversight from the National Association of Corporate Directors and has previous work experience at a large retailer with point-of-sale cybersecurity exposure.
1 unchanged sentence
Any significant issues identified are reported to the Audit Committee of the board of directors on a quarterly basis.
−Removed: As described above, our management team is responsible for the day-to-day assessment and management of material risks from cybersecurity threats through our Chief Financial Officer , our standing management committee on information technology and cybersecurity risk matters and the MSSP.
+Added: As described above, our management team is responsible for the day-to-day assessment and management of material risks from cybersecurity threats through our Chief Financial Officer , our standing management committee on information technology, cybersecurity risk matters, and the MSSP.
This group would be notified through our Incident Response Plan/Policy and appropriate actions undertaken in accordance with the plan document if a cyber-attack were to occur.
−Removed: Our Vice President of Risk Management is a Certificated Information Systems Auditor (CISA) and a Certified Internal Auditor (CIA) and holds a Certificate in Risk Management Assurance (CRMA).
+Added: Our Senior Vice President of Risk Management is a Certificated Information Systems Auditor (CISA) and a Certified Internal Auditor (CIA) and holds a Certificate in Risk Management Assurance (CRMA).
Personnel from the MSSP hold several certifications, including but not limited to:
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.