4 unchanged sentences
We are subject to various cybersecurity risks and continuously monitor and assess our cybersecurity measures to protect against a multitude of cyber threats from adversaries, including nation state actors, that target critical infrastructure sectors such as the defense industrial base.
−Removed: A cybersecurity incident impacting us or our subcontractors or suppliers could materially adversely affect our operations, performance, and results.
+Added: A cybersecurity incident involving us or our subcontractors or suppliers could materially affect our operations, performance, and results.
We expend considerable resources on our cybersecurity management and oversight program designed to identify, manage, and mitigate cybersecurity risks.
3 unchanged sentences
The plan includes procedures for investigating and containing incidents, notifying affected parties, as appropriate, and implementing corrective actions.
−Removed: As a defense contractor, we must comply with DoD cybersecurity requirements for handling Controlled Unclassified Information ("CUI") and requirements in the Defense Federal Acquisition Regulation Supplement ("DFARS") regarding reporting cybersecurity incidents to the DoD, including the DoD’s Cybersecurity Maturity Model Certification ("CMMC") program.
−Removed: We are prepared to participate in this program and obtain associated CMMC certification.
+Added: As a defense contractor, we must comply with DoW cybersecurity requirements for handling Controlled Unclassified Information ("CUI") and requirements in the Defense Federal Acquisition Regulation Supplement ("DFARS") regarding reporting cybersecurity incidents to the DoW, including the DoW’s Cybersecurity Maturity Model Certification ("CMMC") program.
+Added: We are participating in this program and plan to obtain the appropriate CMMC certification.
We also adhere to the standards set forth by the National Institute of Standards and Technology (“NIST”) and the International Organization for Standardization (“ISO”) to ensure the highest level of security and operational excellence.
3 unchanged sentences
We conduct due diligence on the cybersecurity practices and controls on these providers and include provisions in our contracts requiring appropriate cybersecurity measures.
−Removed: In addition, in the case of a third-party cybersecurity incident, we identify and mitigate risks to minimize impacts to us from third-party incidents.
+Added: In addition, in the case of a third-party cybersecurity incident, we identify and mitigate risks to minimize the effects to us from third-party incidents.
We share and receive threat intelligence with our peers in the defense industrial base, government agencies, information sharing and analysis centers, and cybersecurity associations.
4 unchanged sentences
They and the other individuals supporting our information security program demonstrate their cybersecurity expertise through qualifications such as prior work experience, possession of a cybersecurity certification, degree, or other cybersecurity experience.
−Removed: The CISO collaborates with these functions for the purpose of establishing processes and procedures to monitor potential cybersecurity risks, identifying cybersecurity incidents, implementing appropriate mitigation measures, reporting cybersecurity breaches, assessing materiality,
+Added: The CISO collaborates with these functions for the purpose
SCIENCE APPLICATIONS INTERNATIONAL CORPORATION
−Removed: maintaining our cybersecurity program, and other information security incidents.
−Removed: The CISO provides regular updates on our cybersecurity posture and preparedness to senior management.
+Added: of establishing processes and procedures to monitor potential cybersecurity risks, identifying cybersecurity incidents, implementing appropriate mitigation measures, reporting cybersecurity breaches, assessing materiality, maintaining our cybersecurity program, and other information security incidents.
+Added: The CISO provides regular updates and written reports on our cybersecurity posture and preparedness to senior management, the Audit Committee, the Nominating and Corporate Governance Committee and the Board.
Board of Directors' Roles and Responsibilities
−Removed: Our cybersecurity risks and associated mitigations, as part of our enterprise risk management, are continually monitored by senior leadership.
−Removed: These risks and mitigations are also subject to oversight by the Audit Committee and the Risk Oversight Committee (“ROC”) of our Board of Directors.
−Removed: The ROC is the primary committee that oversees enterprise cybersecurity risks and reviews cybersecurity matters, including our policies and procedures for protecting our cybersecurity infrastructure and for compliance with data protection and security regulations, and related risks.
−Removed: The ROC receives information regarding such risks from management, including our CISO, and reports to the Board on a quarterly basis.
−Removed: The ROC also oversees the Board’s response to any significant cybersecurity incidents.
+Added: Our cybersecurity risks and associated mitigations, as part of our enterprise risk management ("ERM"), are continually monitored by senior leadership.
+Added: The Nominating and Corporate Governance Committee of our Board of Directors oversees the ERM process.
+Added: The Chief Risk Officer reports to the Nominating and Corporate Governance Committee on a quarterly basis regarding the ERM program.
+Added: These risks and mitigations are also subject to oversight by the Audit Committee of our Board of Directors.
+Added: The Audit Committee is the primary committee that oversees enterprise cybersecurity risks and reviews cybersecurity matters, including our policies and procedures for protecting our cybersecurity infrastructure and for compliance with data protection and security regulations, and related risks.
+Added: The Audit Committee receives information regarding such risks from management, including our CISO, and reports to the Board on a quarterly basis.
+Added: The Audit Committee also oversees the Board’s response to any significant cybersecurity incidents.
Cybersecurity Threats
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.