1 unchanged sentence
CYBERSECURITY
−Removed: Sinclair maintains a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.
−Removed: This program is integrated within the Company’s enterprise risk management system and disclosure committee.
+Added: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.
+Added: This program is integrated within our enterprise risk management system and disclosure committee.
The program addresses the corporate information technology environment, third-party service providers, and customer-facing products and applications.
−Removed: The Company’s Chief Information Security Officer (“CISO”) is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board, the audit committee and disclosure committee.
+Added: Our Chief Information Security Officer (“CISO”) is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the cybersecurity committee and disclosure committee.
Our CISO has over a decade of experience leading cybersecurity oversight, and others on our IT security team have cybersecurity experience or certifications, such as the Certified Information Systems Security Professional certification.
We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts.
−Removed: At the management level, our IT security team identifies risks by regularly monitoring alerts, meeting to discuss threat levels, trends, and remediation, and immediately informing the CISO, whom leads the IT security team, upon the occurrence of any material event.
+Added: At the management level, our IT security team identifies risks by regularly monitoring alerts, meeting to discuss threat levels, trends, and remediation, and immediately informing the CISO, who leads the IT security team, upon the occurrence of any material event.
The processes used to assess the risk level includes preparing a monthly cyber scorecard, regularly collecting data on cybersecurity threats and risk areas, and conducting an annual risk assessment.
5 unchanged sentences
We also require employees in certain roles to complete additional role-based, specialized cybersecurity training.
−Removed: We utilize our Internal Audit team to assess the design and operating effectiveness of our internal controls, including those that relate to our IT security environment.
−Removed: Further, we maintain various cyber insurance policies and believe we are adequately covered in the event we experience a cybersecurity breach.
+Added: We maintain cybersecurity insurance;
+Added: however, coverage may be insufficient and may not cover all losses (including business interruption, reputational harm, regulatory penalties, or litigation).
In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with the use of third-party service providers.
−Removed: Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on sensitive data shared with third parties.
−Removed: The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (“SOC”) 1 or SOC 2 report.
+Added: Our IT security team conducts a review of third-party hosted applications including a focus on sensitive data shared with third parties, at least annually, but also upon entering into a new agreement that contains the use of a hosted application or if there is a significant change to such a contract.
+Added: The internal business owners of the hosted applications are required to document user access reviews at least annually and provide a System and Organization Controls (“SOC”) 1 or SOC 2 report from the vendor.
If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis.
Our assessment of risks associated with the use of third-party providers is part of our overall cybersecurity risk management framework.
−Removed: The Board oversees the Company’s cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks.
−Removed: The CISO briefs the Board on the effectiveness of the Company’s cyber risk management program, typically on a quarterly basis.
+Added: The Board oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks.
+Added: The CISO briefs the cybersecurity committee on the effectiveness of the Company’s cyber risk management program, typically on a quarterly basis.
In addition, cybersecurity risks are reviewed by the Board, at least annually, as part of the Company’s corporate risk management process.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.