5 unchanged sentences
We aim to incorporate industry best practices throughout our Cybersecurity Program.
−Removed: It is founded on the NIST’s Cybersecurity Framework (Identify, Protect, Detect, Respond and Recover) and includes elements of ISO 27001 standards, NIST SP 800-171 guidance, the ISO, and other applicable industry standards for protecting controlled unclassified information.
+Added: It is founded on the NIST’s Cybersecurity Framework (Identify, Protect, Detect, Respond and Recover) and includes elements of ISO 27001 standards, NIST SP 800-171 guidance, the ISO, and other
+Added: applicable industry standards for protecting controlled unclassified information.
The Cybersecurity Program also incorporates preventative, detective and corrective controls to identify relevant cyber risks.
−Removed: The controls are tested and evaluated on a regular basis and include the following controls:
+Added: The controls are tested and evaluated on a regular basis and include:
network and endpoint protection technologies that are designed to block and detect security events at the perimeter and within our networks;
evaluation and monitoring of detected security events;
−Removed: documented incident response actions and procedures.
+Added: and documented incident response actions and procedures.
In addition to internal assessments, third party security firms perform annual risk reviews to evaluate and assess the Cybersecurity Program.
4 unchanged sentences
and notifying us in the event of any known or suspected cyber incident.
−Removed: Our CIDO is responsible for leading the Cybersecurity Program, which is coordinated and primarily executed by our Director of Information Security and Compliance.
+Added: Our VP of Information Technology is responsible for leading the Cybersecurity Program, which is coordinated and primarily executed by the Chief Information Security Officer.
Our Board of Directors, primarily through the Audit Committee, oversees our enterprise risk management program, including cybersecurity risks.
The enterprise risk management program is utilized in making decisions with respect to our Company’s priorities, resource allocation, and oversight structures.
−Removed: Our CIDO and/or Director of Information Security and Compliance deliver updates on the Cybersecurity Program to our Board of Directors semi-annually, including with respect to significant projects and initiatives.
+Added: Our VP of Information Technology and/or Chief Information Security Officer deliver updates on the Cybersecurity Program to our Board of Directors semi-annually, including with respect to significant projects and initiatives.
These updates consist of a report to the full Board of Directors and to the Audit Committee, and cover a wide range of topics, including evolving regulations and standards, vulnerability assessments, mitigation strategies, third-party and independent reviews, the evolving threat environment, technological and industry trends, and information security considerations arising with respect to our Company’s peers and other third parties.
−Removed: Our CIDO and/or Director of Information Security and Compliance will also provide reports of material cybersecurity incidents or other relevant developments to our Board of Directors and Audit Committee as and when needed.
−Removed: Furthermore, our CIDO and/or Director of Information Security and Compliance provide periodic updates to our senior management regarding cybersecurity risks, as well as interim updates during regular meetings with our leadership team.
+Added: Our VP of Information Technology and/or Chief Information Security Officer will also provide reports of material cybersecurity incidents or other relevant developments to our Board of Directors and Audit Committee as and when needed.
+Added: Furthermore, our VP of Information Technology and/or Chief Information Security Officer provide periodic updates to our senior management regarding cybersecurity risks, as well as interim updates to our leadership team.
For a discussion regarding risks from cybersecurity threats that have or are reasonably likely to materially affect our Company, see the risk factor titled “A significant disruption in, or breach in security of, our information technology systems or violations of data protection laws could materially adversely affect our business and reputation” in “Item 1A.
−Removed: Risk Factors” of this Annual Report on Form 10-K.
+Added: Risk Factors.”
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.