10 unchanged sentences
remote working environments;
−Removed: and reputational risks.
+Added: third-party risks;
+Added: technology risks and reputational risks.
We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage these risks.
1 unchanged sentence
Cybersecurity risks are managed through technological, process, and administrative controls that are designed to target the mitigation of risk to levels acceptable to the business.
−Removed: Risk assessment and management include processes for managing third-party cybersecurity risk.
+Added: Risk assessment and management include processes for
+Added: managing third-party cybersecurity risk.
These processes provide that third-party cybersecurity risk assessments are to be performed prior to a vendor’s engagement, upon contract renewal, and as we may otherwise require.
4 unchanged sentences
These tools include cloud security posture management, workload protection, endpoint detection and response, network firewalls and intrusion detection systems, identity and access management tools, data protection technologies and logging, monitoring, and alerting tools.
−Removed: Accompanying these tools are various processes such as security education and awareness training, security maturity assessments, vulnerability assessments, threat intelligence and hunting, penetration testing, and tabletop exercises to inform our professionals’ risk identification and assessment.
+Added: Accompanying these tools are various processes such as annual security education and monthly awareness training, security maturity assessments, vulnerability assessments, threat intelligence and hunting, penetration testing, and tabletop exercises to inform our professionals’ risk identification and assessment.
We practice data protection techniques and processes that are designed to treat our customer data with care.
We also utilize third-parties, consultants, and auditors to regularly assess our security program.
−Removed: These assessments include periodic security maturity assessments in which third-parties assess security program
−Removed: maturity against established standards and industry benchmarks.
+Added: These assessments include periodic security maturity assessments in which third-parties assess security program maturity against established standards and industry benchmarks, including NIST Cybersecurity Framework 2.0.
We also annually engage a Qualified Security Assessor to conduct payment card industry certification on all applicable products and solutions.
18 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.