3 unchanged sentences
Responsibility for cybersecurity risk management comes from a collective effort, with day-to-day oversight and management from our executive and information technology ("IT") teams.
−Removed: Additionally, the Audit Committee continues to take a more active role in setting both proactive and reactive strategies, with the overall Board overseeing our efforts and helping to guide our strategy.
−Removed: From a framework standpoint, we primarily utilize the National Institute of Standards and Technology ("NIST") framework to assess and mitigate cybersecurity risks.
−Removed: This framework guides our efforts to identify, analyze and contain any security threats, and advises as to potential actions to consider if a need arose to recover from a security incident.
−Removed: Our primary source of cybersecurity risk relates to security of our third-party service providers, whose activities and scale may present more desirable targets.
+Added: Additionally, the Audit Committee continues to take an active role in setting both proactive and reactive strategies, with the overall Board overseeing our efforts and helping to guide our strategy.
+Added: We primarily utilize the National Institute of Standards and Technology ("NIST") framework to assess and mitigate cybersecurity risks.
+Added: This framework guides our efforts to identify, analyze and contain any security threats, and advises as to potential actions to consider if a need arises to recover from a security incident.
+Added: Our primary source of cybersecurity risk relates to the security practices of our third-party service providers, whose activities and scale may present more desirable targets.
However, we do maintain certain systems ourselves and appreciate the need to focus internally as well.
3 unchanged sentences
Within the Company, administrative access to various systems is limited so that there is no universal access if an administrator-level account is compromised.
−Removed: We involve our IT team when negotiating contracts that could increase our cybersecurity risk exposure, so that the team is aware of the specific risks related to a given vendor and can provide feedback and advice on the contractual provisions necessary to prevent a cybersecurity incident, or in the event an incident does occur, to ensure that the Company has the necessary rights to act quickly to protect team members, guests, and our business and mitigate potential damage.
−Removed: We are continuously improving our processes and contract positions to reflect evolving risks and market
−Removed: Portillo's Inc.
−Removed: Form 10-K | 16
+Added: We involve our IT team when negotiating contracts that could increase our cybersecurity risk exposure, so that the team is aware of the specific risks related to a given vendor and can provide feedback and advice on the contractual provisions necessary to prevent a cybersecurity incident, or in the event an incident does occur, to ensure that the Company has the necessary rights to act quickly to protect team members, guests, and our business, while mitigating potential damage.
+Added: We are continuously improving our processes and contract positions to reflect evolving risks and market practices.
+Added: This includes the implementation of a vendor security standards program, that establishes security requirements for vendors that are based on the NIST framework.
We appreciate the need to monitor and test our systems to make sure that they are working the way that they should.
We negotiate with our vendors about a variety of monitoring, testing, and reporting provisions so that we can work with them to better address vulnerabilities.
−Removed: This may include sharing SOC 1 or 2 Type 2 audit reports, conducting periodic penetration and vulnerability testing, both internally and externally, and confirmation that vendors are adhering to applicable laws.
+Added: This may include sharing SOC 1 or 2 Type 2 audit reports, conducting periodic penetration and vulnerability testing, both internally and externally, and confirmation
+Added: Portillo's Inc.
+Added: Form 10-K | 16
+Added: that vendors are adhering to applicable laws.
Some of this testing and monitoring is conducted in-house and some is conducted by third-party vendors.
−Removed: We routinely conduct penetration testing across our various environments and networks, including our Restaurant Support Center, our restaurants and our cloud-based architecture and systems.
−Removed: We review penetration testing outcomes and take steps to address any meaningful findings, while documenting resolution steps these efforts.
+Added: We routinely conduct penetration testing across our various environments and networks, including our RSC, our restaurants and our cloud-based architecture and systems.
+Added: We review penetration testing outcomes and take steps to address any meaningful findings, while documenting the resolution process.
+Added: We control access to various AI platforms that are used to support our business operations, to ensure a heightened level of data protection.
+Added: We block access to various AI platforms that do not support our business operations.
+Added: We ensure that secure and managed enterprise licenses are used to access AI systems.
We work with team members at all levels to educate them about evolving risks, from well-known tactics and scams (e.g., phishing) to their more sophisticated descendants (e.g., spear phishing and smishing).
4 unchanged sentences
The Company also maintains a cybersecurity insurance policy that we believe is appropriate for a company of our size and risk profile, but it is possible that it may not fully cover the costs associated with a cybersecurity incident.
−Removed: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business strategy, results of operations or financial condition.
+Added: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our Results.
However, there is no guarantee that a future cybersecurity incident would not materially affect our future strategy, results or financial condition.
6 unchanged sentences
The IT Team manages day-to-day cybersecurity risks under the oversight of our Chief Information Officer ("CIO") , who is actively engaged in strategic planning, security assessments, and mitigation efforts.
−Removed: Our CIO has 10+ years of experience overseeing security practices at various multi-national restaurant concepts.
+Added: Our CIO has over ten years of experience overseeing security practices at various multi-national restaurant concepts.
Our CIO and Chief Financial Officer discuss IT matters on a routine basis, and as noted above, periodic reviews are conducted with the executive management team and the Audit Committee.
−Removed: We have an incident response process that is activated in the event of a direct or third-party attack.
+Added: We have a Security Committee comprised of cross-functional leaders to assess and respond to security incidents, and we have an incident response process that is activated in the event of a direct or third-party attack.
The plan is designed to help us detect, respond to and recover from cybersecurity incidents.
5 unchanged sentences
The internal and external headcount, and the expertise of the employees and consultants, will change from time to time as we adapt to the changing cybersecurity environment.
+Added: Portillo's Inc.
+Added: Form 10-K | 17
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.