9 unchanged sentences
We have undertaken table-top risk exercises and employees participate in mandatory annual trainings and receive communications regarding the cybersecurity environment to increase awareness throughout the Company.
−Removed: The Company's cybersecurity program is based on the U.S.
−Removed: National Institute for Standards and Technology Cybersecurity Framework.
+Added: The Company's cybersecurity program is informed by industry-recognized security frameworks such as the U.S.
+Added: National Institute of Standards and Technology Cybersecurity Framework.
We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate.
4 unchanged sentences
Our Audit Committee is responsible for reviewing and overseeing the Company's data privacy, information technology and security and cybersecurity risk exposures and the guidelines, programs and steps implemented by management to assess, manage and mitigate any such exposures.
−Removed: The ERM Committee reports to the Audit Committee at least annually on the Company's enterprise risk management and will report security instances to the Audit Committee as they occur, if material.
+Added: The ERM Committee reports to the Audit Committee at least annually on the Company's enterprise risk management and will report cybersecurity incidents to the Audit Committee as they occur, if material.
Cybersecurity Risks
2 unchanged sentences
For a discussion of our cybersecurity risks, refer to "Part I - Item 1A.
−Removed: Risk Factors - Risks Related to Our Business - Cyber threats and the risk of cybersecurity incidents affecting our information technology systems or the information technology systems of our hotel managers or third-party service providers could materially adversely affect our business" included elsewhere within this Annual Report on Form 10-K.
+Added: Risk Factors - Risks Related to Our Business - Cyber threats and the risk of cybersecurity incidents affecting our hotel managers' or our own information technology and systems, including third-party service providers, could materially adversely affect our business" included elsewhere within this Annual Report on Form 10-K.
Although we have experienced cybersecurity incidents, to date, none have had a material adverse effect on us.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.