2 unchanged sentences
CYBERSECURITY
−Removed: Our business requires that we develop and maintain large and complex technology systems, and that we rely on third-party systems and applications, to run our operations and to store the significant volume of data that we acquire, including the personal information of our customers and employees and our intellectual property, trade secrets, and other sensitive business and financial information.
+Added: Our business requires that we develop and maintain large and complex technology systems, and that we rely on third-party systems and applications, to run our operations and to store the significant volume of data and information that we acquire, including the personal information of our customers and employees and our intellectual property, trade secrets, and other sensitive business and financial information.
Our overall efforts to safeguard the information systems and confidential information critical to our operations include preventative and detective internal processes, technological defenses, and other controls designed to provide multiple layers of security protection.
2 unchanged sentences
This integrated approach to protect data and information systems is also built into our project management, development, and operations.
−Removed: To assess the effectiveness of our cybersecurity program and compliance with applicable rules, regulations, and laws, we employ internal resources and, regularly, external resources, to evaluate our environment, information systems, and processes.
+Added: To assess the effectiveness of our cybersecurity program and compliance with applicable rules, regulations, and laws, we employ a variety of internal resources to evaluate our environment, information systems, and processes.
+Added: In addition, we engage third parties to test the vulnerability of our cybersecurity infrastructure on a regular basis and we have a third-party assessment performed annually.
Through appropriate risk evaluation, security assessments, and financial due diligence, we seek to protect the security and confidentiality of information provided to our vendors under service provider cloud computing or other arrangements.
4 unchanged sentences
Our Chief Security Officer (CSO) is ultimately responsible for cybersecurity at Progressive, with management oversight of the prevention, detection, mitigation, and remediation of cybersecurity incidents.
−Removed: The CSO reports directly to the Chief Financial Officer and provides regular cybersecurity updates to the Chief Executive Officer, other members of the executive team, and the Board of Directors’ Technology Committee.
−Removed: Our CSO has served in this capacity at Progressive for more than 11 years and, prior to joining us, had over 10 years of cybersecurity experience in the banking industry.
+Added: The CSO reports directly to the Chief Financial Officer and provides regular cybersecurity updates to the CEO, other members of the executive team, and the Board of Directors’ Technology Committee.
+Added: Assuming the role in 2012, our CSO has served in this capacity at Progressive for more than a decade and, prior to joining us in 2010, had over 10 years of cybersecurity experience in the banking industry in security and risk management leadership roles, primarily focused on cybersecurity and banking compliance, with additional experience in the areas of anti-money laundering and financial fraud.
Our CSO is also a member of our Management Risk Committee, which leads our Enterprise Risk Management program, and as a member ensures that cybersecurity risks remain a focus of the overall risk management process.
The Technology Committee of the Board of Directors oversees our use of technology in business strategy as well as the major risks arising from our technology, digital and data strategies, legacy information systems, technology investments, data privacy, operational performance, cybersecurity programs, and technology-related business continuity and disaster recovery programs.
−Removed: The Technology Committee, which includes directors with technology and cybersecurity experience, also oversees management’s effort to mitigate these risks.
+Added: The Technology Committee, which includes directors with technology experience, also oversees management’s effort to mitigate these risks.
Technology Committee meetings typically occur five times a year.
4 unchanged sentences
However, we cannot guarantee that we will not be materially affected in the future.
−Removed: Cybersecurity risks rapidly evolve and are complex, so we must continually adapt and enhance our processes and defenses.
+Added: Cybersecurity risks evolve rapidly and are complex, so we must continually adapt and enhance our processes and defenses.
As we do this, we must make judgments about where to invest resources to most effectively protect ourselves from cybersecurity risks.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.