16 unchanged sentences
A subset of vendors that meet a predetermined risk profile due to strategic relationships, technology risk, or other factors is continually monitored by a third-party risk management service, and the Company annually reviews independent assessments of these vendors.
−Removed: The Cybersecurity Group also has documented processes for identifying, responding to, and internally escalating cybersecurity incidents.
−Removed: Once an incident meets certain criteria, the Company’s Cybersecurity Incident Command or, in the most severe cases that impact the entire Company, the Corporate Emergency Operations Center is activated and formal response procedures are followed to address the incident.
+Added: The Cybersecurity Group also has documented processes for identifying, responding to, and internally escalating cybersecurity incidents to management and the Board of Directors.
+Added: Once an incident meets certain criteria, the Company’s Cybersecurity Incident Command or, in the most severe cases that
+Added: impact the entire Company, the Corporate Emergency Operations Center is activated and formal response procedures are followed to address the incident.
The Cybersecurity Group has a formal incident response plan that details response and escalation procedures, including activation of a Cybersecurity Disclosure Committee, consisting of the Chief Financial Officer and the General Counsel, to assess an incident’s materiality with input as needed from the Director of Cybersecurity, Chief Accounting Officer, Chief Information Officer, and others, including outside advisors.
1 unchanged sentence
The Enterprise Risk Management Program is overseen by an executive committee (the “ Executive Risk Committee ”), which meets at least quarterly and is comprised of members holding executive leadership positions in the Company, including the Chairman and Chief Executive Officer, President, and other Executive and Senior Vice Presidents, and is chaired and sponsored by the Chief Financial Officer.
−Removed: Every year, as a part of the Enterprise Risk Management Program, the top risks affecting the Company are identified.
−Removed: For 2023, cybersecurity was identified as a top risk.
+Added: Every year, as a part of the Enterprise Risk Management Program, risks affecting the Company are identified.
+Added: For 2024, cybersecurity was identified as a risk.
The applicable subject matter experts brief the Company’s Board of Directors on the status of all top enterprise risks at least once per year.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.