15 unchanged sentences
Our cybersecurity program is based on recognized best practices and standards for cybersecurity, such as the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework.
−Removed: We conduct regular third-party assessments of our cyber risk management program.
−Removed: We also conduct a periodic assessment of cybersecurity risk as part of broader enterprise risk management (ERM).
+Added: We conduct regular third-party assessments of our cyber risk management program, and also conduct a periodic assessment of cybersecurity risk as part of broader enterprise risk management (ERM).
This assessment includes an evaluation of the Company’s processes to identify and respond to cyber risks and the effectiveness of the Company’s lines of defense.
−Removed: Given the complexity and evolving nature of cybersecurity threats, we leverage both internal cyber analytics and external sources of threat intelligence (including assessors, consultants, and other third parties) to evaluate our cyber risks and to properly adjust our risk mitigation approach.
+Added: Given the complexity and evolving nature of cybersecurity threats, we leverage both internal cyber analytics and external sources of threat intelligence to evaluate our cyber risks and to properly adjust our risk mitigation approach.
+Added: We engage third parties to perform periodic assessment of our cyber program maturity against the NIST framework, to perform penetration testing, and to audit our capabilities from time to time.
We also maintain controls and procedures that are designed to evaluate cyber risks on an ongoing basis.
These processes include prompt communication of certain cybersecurity incidents to the Company’s executives, internal committees and the Board as needed, so that any needed external reporting can be made by management and the Board in a timely manner.
−Removed: Our policies require each of our employees to contribute to our data security efforts.
+Added: Our policies require each of our employees and crew members to contribute to our data security efforts.
We regularly educate our employees about the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.
5 unchanged sentences
Our CIO and CISO have more than 35 years of collective experience in the cybersecurity field.
−Removed: The CISO reports to the CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our networks and systems.
+Added: The CISO reports to the CIO and is generally responsible for management of cybersecurity risk and the protection and defense of our networks, systems, and data.
The CISO has served in similar roles at three major public companies and is a recognized cybersecurity leader.
He regularly engages with peer CISOs, cybersecurity experts and organizations, including the Cloud Security Alliance (CSA) and the NIST, to stay informed on the latest industry developments.
−Removed: The CISO regularly informs our internal Disclosure Committee, Chief Financial Officer, and our President and Chief Executive Officer of cybersecurity risks and incidents as per our internal cyber risk framework.
+Added: The CISO regularly informs our internal Disclosure Committee, Chief Financial Officer, and our President and Chief Executive Officer of cybersecurity risks and incidents as per our internal cyber risk
This also helps ensure that the highest levels of management are kept abreast of our cybersecurity posture and potential risks.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.