2 unchanged sentences
Our management and Board of Directors (the “Board”) recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our customers, dealers, business partners, employees and investors.
−Removed: The Board is actively involved in our risk management practices, including oversight of our overall enterprise risk management (“ERM”) program, in which cybersecurity risk is included.
−Removed: Our cybersecurity program is aligned with the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”) and leverages International Organization for Standardization and other applicable industry standards.
+Added: The Board oversees our risk management practices, including our overall enterprise risk management (“ERM”) program, in which cybersecurity risk is included.
+Added: Our cybersecurity program is aligned with the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”) and leverages the International Organization for Standardization and other applicable industry standards.
Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our connected products.
3 unchanged sentences
Security governance
−Removed: We have established processes to assess, identify and manage material risks from cybersecurity threats.
−Removed: Annual risk assessments are performed and incorporated as part of our ERM organizational process.
−Removed: Strategic and operational cybersecurity risks are assessed, identified and managed by our cybersecurity team, which is led by our Chief Information Security Officer (the “CISO”).
−Removed: Our cybersecurity team shares information regarding such risks with our Security Steering Committee, which consists of our Chief Financial Officer, General Counsel, Chief Human Resources Officer, Chief Technology Officer and Chief Supply Chain Officer, and our ERM function, both of which support the Board’s oversight of cybersecurity risk.
+Added: We have established processes aimed to assess, identify and manage material risks from cybersecurity threats.
+Added: Our ERM organizational process includes annual risk assessments.
+Added: Our cybersecurity team, which is led by our Chief Information Officer and Chief Information Security Officer (the “CIO/CISO”), is responsible for identifying, assessing and managing strategic and operational cybersecurity risks.
+Added: Our cybersecurity team shares information regarding such risks with our Security Steering Committee , which consists of our General Counsel, Chief Financial Officer, CIO/CISO, and members of our IT, Legal and ERM functions.
+Added: Both our Security Steering Committee and our ERM function support the Board’s oversight of cybersecurity risk.
Technical safeguards
−Removed: We deploy technical safeguards that are designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls.
+Added: We deploy technical safeguards designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls.
Ongoing enhancements are integrated into our security roadmap, as informed by our security audits and assessments.
Security and privacy incident response
−Removed: We have in place an incident response plan to identify, protect, detect, respond to and recover from cybersecurity threats and incidents.
−Removed: The CISO, the Security Steering Committee, our Chief Executive Officer and the Board are notified of any material cybersecurity incidents through an established escalation process.
−Removed: Our incident response team maintains a standard playbook to respond to any potential cybersecurity incidents.
+Added: We maintain an incident response plan to identify, protect, detect, respond to and recover from cybersecurity threats and incidents.
We test and evaluate our plans on a regular basis.
+Added: The CIO/CISO, the Security Steering Committee, our Chief Executive Officer and the Board are notified of any material cybersecurity incidents through an established escalation process.
Third-party risk management
−Removed: We maintain a risk-based third-party risk management process to identify, assess and manage risks presented by service providers, vendors and other third parties that access our systems or that process or store our data.
+Added: We maintain a risk-based third-party risk management process designed to identify, assess and manage risks presented by service providers, vendors and other third parties that access our systems or that process or store our data.
Security awareness and training
9 unchanged sentences
The results of the assessments are included for review by the Security Steering Committee and the Audit and Finance Committee of the Board.
−Removed: We believe our cybersecurity program is enhanced with the results of the audits, assessments and reviews performed.
+Added: We look to enhance our cybersecurity program with the results of the audits, assessments and reviews we perform.
The Board is responsible for general oversight of our risk management, including cybersecurity risk.
The Audit and Finance Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity and data protection, as well as the steps management has taken to monitor and control such exposures.
−Removed: Cybersecurity reviews are conducted at least quarterly and reported to the Board or the Audit and Finance Committee by the CISO and/or Chief Financial Officer at least quarterly.
−Removed: Our cybersecurity team, which assesses and manages our risks from cybersecurity threats, is led by the CISO, who reports to our Chief Financial Officer.
−Removed: Additional oversight for assessing and managing cybersecurity risk include the Security Steering Committee and as part of our ERM program.
−Removed: The CISO has over 20 years of cybersecurity and technology experience and has previously held Chief Information Security Officer positions at a large public retail company, as well as at a public technology company and services organization.
−Removed: The CISO has an undergraduate degree in Management Information Systems.
−Removed: Members of our cybersecurity team have, combined, over 100 years of cybersecurity experience, have degrees including Bachelors in Information Systems, Management Information Systems and/or Masters in Security Technologies, and hold professional certifications including Certified Information Systems Security Professional, Global Information Assurance Certification Security Essentials, Certified Cloud Security Professional, Certified Information Systems Auditor, Microsoft Cybersecurity Architect Expert and/or Certified Digital Forensics Examiner.
+Added: We conduct cybersecurity audits and assessments on a regular basis and either our CIO/CISO or Chief Financial Officer report to the Audit and Finance Committee on a quarterly basis.
+Added: Our cybersecurity team, which is responsible for assessing and managing our risks from cybersecurity threats, is led by the CIO/CISO , who reports to our Chief Financial Officer.
+Added: The Security Steering Committee provides additional oversight for assessing and managing cybersecurity risk.
+Added: The CIO/CISO has over 20 years of cybersecurity and technology experience and has previously held Chief Information Security Officer positions at a large public retail company, as well as at a public technology company and services organization.
+Added: The CIO/CISO has an undergraduate degree in Management Information Systems.
+Added: Members of our cybersecurity team have broad experience in security functions in various industries.
Our Chief Executive Officer, Chief Financial Officer and General Counsel each hold degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.