2 unchanged sentences
Cybersecurity Risk Management and Strategy
−Removed: Our cybersecurity risk management strategy is a key component and has been integrated into our overall enterprise risk management program and has been designed based on established industry frameworks and standards, including those developed by the National Institute of Standards and Technology and the US Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) program.
+Added: Our cybersecurity risk management strategy is a key component and has been integrated into our overall enterprise risk management program and has been designed based on established industry frameworks and standards, including those developed by the National Institute of Standards and Technology and the US Department of War’s Cybersecurity Maturity Model Certification (CMMC) program.
Although this does not mean that we currently meet all of any particular technical standards, specifications, or requirements, we use these frameworks, complemented by insights from internal assessments, to guide the development of policies governing the use of our information assets, access to intellectual property, and the safeguarding of personal information.
3 unchanged sentences
Throughout the year, our employees undergo regular cybersecurity awareness training, receive guidance on protecting confidential information, and participate in simulated phishing exercises.
−Removed: We maintain a cybersecurity incident response plan that includes a cross-functional response team and procedures for responding to cybersecurity incidents.
+Added: We maintain a cybersecurity incident response plan that includes a cross-functional response team and procedures for evaluating, responding to and reporting cybersecurity incidents.
We engage third-party assessors to conduct penetration testing and evaluate our adherence to industry-standard frameworks.
8 unchanged sentences
Our Board of Directors (the “Board”) holds collective oversight responsibility for our strategic and operational risks.
−Removed: Assisting the Board in this capacity, our Audit Committee thoroughly reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management.
+Added: Assisting the Board in this capacity, our Audit Committee reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management.
The Audit Committee provides periodic reports on these reviews to the full Board of Directors.
Management bears the responsibility for the day-to-day assessment and management of cybersecurity risks.
−Removed: Our Chief Information Officer (CIO) assumes primary oversight of material risks stemming from cybersecurity threats.
−Removed: With over 20 years of experience across various information technology roles, our CIO also serves as the Vice President accountable for the Information Technology organization and information protection.
−Removed: Reporting directly to our CIO, our Cybersecurity Manager brings over 15 years of experience in aerospace IT organizations, coupled with more than 10 years of expertise in cybersecurity.
−Removed: Our CIO and Cybersecurity Manager evaluate our cybersecurity readiness through a combination of internal assessment tools and third-party control tests, vulnerability assessments, audits, and alignment with industry standards.
+Added: Our VP Global Information Technology assumes primary oversight of material risks stemming from cybersecurity threats.
+Added: With over 40 years of experience across various information technology roles, our VP Global Information Technology is accountable for the Information Technology organization and information protection.
+Added: Reporting directly to our VP Global Information Technology, our Cybersecurity leader brings over 15 years of experience in aerospace IT organizations, coupled with more than 10 years of expertise in cybersecurity.
+Added: Our VP Global Information Technology and Cybersecurity leader evaluates our cybersecurity readiness through a combination of internal assessment tools and third-party control tests, vulnerability assessments, audits, and alignment with industry standards.
We maintain governance and compliance structures tailored to promptly escalate cybersecurity-related matters to our cybersecurity team, addressing potential threats or vulnerabilities.
1 unchanged sentence
Moreover, we implement diverse defensive measures and continuous monitoring techniques, leveraging established industry frameworks and cybersecurity standards, including collaboration with third-party security operations centers.
−Removed: Our CIO conducts periodic meetings with the Audit Committee to review our information technology systems and address significant cybersecurity risks.
+Added: Our VP Global Information Technology or Cybersecurity leader conducts periodic meetings with the Board or Audit Committee to review our information technology systems and address significant cybersecurity risks.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.