17 unchanged sentences
Our CISO works closely with the company’s Senior Counsel, Intellectual Property and Data Protection, to oversee compliance with legal, regulatory and contractual security requirements.
−Removed: Index to Financial Statements
Risk Management and Strategy
5 unchanged sentences
If the SIEM system identifies a potential security event, it can direct other controls to stop the activity and also generate alerts for detection and response.
−Removed: These alerts are monitored by a managed security service provider that augments a dedicated internal Security Operations Center team.
+Added: These alerts are monitored by a managed security service provider that augments our dedicated internal Security Operations Center team.
In addition, we utilize a third-party risk management (TPRM) program to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks.
1 unchanged sentence
Our policies and procedures aid in the governance from initial due diligence, selection, and contracting to termination.
−Removed: With respect to cybersecurity incident response, our ECIRP provides a standardized framework for responding to cybersecurity incidents.
+Added: With respect to cybersecurity incident response, our ECIRP provides a documented framework for responding to cybersecurity incidents.
The ECIRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.
−Removed: Internal audit performs audits of our cybersecurity program.
+Added: Our Internal Audit organization performs audits of our cybersecurity program.
Each year, we conduct audits across the company’s information technology and operation technology infrastructure, networks, systems, applications, and operational processes and procedures to evaluate compliance with our information security policies and standards.
−Removed: Process control network assurance audits are conducted on a rotating schedule that is risk-based and provides coverage across each operational business area no greater than five years.
+Added: Process control network assurance audits are conducted on a rotating schedule that is risk-based and provides coverage across each major operational business area no greater than five years.
In addition to the internal audits, we also engage external cybersecurity experts and auditors to conduct assessments, penetration testing, and cybersecurity maturity assessments .
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.