3 unchanged sentences
Cybersecurity Risk Management and Strategy
−Removed: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats.
+Added: We recognize the importance of identifying, assessing, and managing material risks associated with cybersecurity threats.
We maintain a dedicated cybersecurity risk management function, which is integrated as part of our overall enterprise risk management program.
9 unchanged sentences
Cybersecurity risks are managed through technological, process, and administrative controls that are designed to target the mitigation of risk to levels acceptable to the business.
−Removed: Risk assessment and management include processes for
−Removed: managing third-party cybersecurity risk.
+Added: Risk assessment and management include processes for managing third-party cybersecurity risk.
These processes provide that third-party cybersecurity risk assessments are to be performed prior to a vendor’s engagement, upon contract renewal, and as we may otherwise require.
Our formal cybersecurity policy program, which includes a collection of security policies and procedures, is in place to establish requirements, standards, and security controls designed to protect Sabre's technology environment.
−Removed: We employ information technology and cybersecurity technologies that are designed to protect Sabre's technology environment, detect threats, respond to threats and help support operational resilience.
+Added: We employ information technology and cybersecurity solutions that are designed to safeguard Sabre's technology environment, detect and respond to threats and help support operational resilience of our technology products.
These technologies facilitate the identification of threats and vulnerabilities that may exist in the Sabre technology environment.
Protective measures are employed to counter threats and mitigate risk, supporting operational resilience of our technology products.
−Removed: These tools include cloud security posture management, workload protection, endpoint detection and response, network firewalls and intrusion detection systems, identity and access management tools, data protection technologies and logging, monitoring, and alerting tools.
+Added: Cybersecurity solutions include cloud security posture management, workload protection, endpoint detection and response, network firewalls and intrusion detection systems, identity and access management tools, data protection technologies and logging, monitoring, and alerting tools.
Accompanying these tools are various processes such as annual security education and monthly awareness training, security maturity assessments, vulnerability assessments, threat intelligence and hunting, penetration testing, and tabletop exercises to inform our professionals’ risk identification and assessment.
We practice data protection techniques and processes that are designed to treat our customer data with care.
−Removed: We also utilize third-parties, consultants, and auditors to regularly assess our security program.
−Removed: These assessments include periodic security maturity assessments in which third-parties assess security program maturity against established standards and industry benchmarks, including NIST Cybersecurity Framework 2.0.
+Added: We also utilize independent third-parties, consultants, and auditors to regularly assess our security program.
+Added: These assessments include security maturity assessments in which third-parties assess our security program maturity against established standards and industry benchmarks, including NIST Cybersecurity Framework 2.0.
We also annually engage a Qualified Security Assessor to conduct payment card industry certification on all applicable products and solutions.
−Removed: Our cybersecurity incident response plan describes the activities we take to identify, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to provide appropriate reporting and escalation.
−Removed: The program includes appropriate activities to escalate potentially material security incidents to our disclosure committee for review.
−Removed: Based on the information we have as of the date of this Annual Report with respect to the periods beginning with those covered by this Annual Report, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
+Added: Our cybersecurity incident response plan describes the activities we take to identify, detect, respond to and recover from cybersecurity incidents.
+Added: This plan includes processes to triage, assess severity for, contain, investigate, and remediate the incident, as well as to provide appropriate reporting and escalation.
+Added: The plan also includes appropriate procedures for escalating potentially material security incidents to our disclosure committee for review.
+Added: Based on the information we have as of the date of this Annual Report on Form 10-K with respect to the periods beginning with those covered by this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
We, like most technology companies, are the target of cybercriminals who attempt to compromise our systems.
We describe risks relating to cybersecurity threats, including as a result of previous cybersecurity incidents in “Item 1A.
−Removed: Risk Factors” in this Annual Report on Form 10-K, under the headings “Our success depends on maintaining the integrity of our systems and infrastructure, which may suffer from failures, capacity constraints, business interruptions and forces outside our control.” and “Security incidents expose us to liability and could damage our reputation and our business.”
+Added: Risk Factors” in this Annual Report on Form 10-K, under the headings “Our success depends on maintaining the integrity of our systems and infrastructure, which may suffer from failures, capacity constraints, business interruptions and forces outside of our control.” and “Security incidents expose us to liability and could damage our reputation and our business.”
Cybersecurity Governance
−Removed: The Audit Committee of our Board of Directors has oversight authority to review our plans to mitigate cybersecurity risk.
+Added: The Audit Committee of our Board of Directors has oversight authority to review our program and plans for mitigating cybersecurity risk.
At least quarterly, the Audit Committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards risk-management-related goals, our incident response plan, and potentially material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to these risks.
9 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.