5 unchanged sentences
Our information security program features risk management strategies, security awareness training, security operations, incident response, security governance, third-party risk management, IT security risk management, security architecture, and vulnerability management.
−Removed: 20 Service Corporation International
Managing Material Risks & Integrated Overall Risk Management
Cybersecurity risk management is integrated into our broader enterprise risk management system, and cybersecurity risk is strategically reviewed, monitored and managed alongside other enterprise risks on a regular basis.
−Removed: Our information security program is designed to evaluate, identify, and manage risks from cybersecurity threats and vulnerabilities, including malware, phishing, hacking, social engineering, and data breaches.
−Removed: Our program is regularly assessed using the NIST Cybersecurity Framework, and information security training is provided to our employees.
+Added: Our information security program is designed to evaluate, identify, and manage risks from cybersecurity threats and vulnerabilities, including malware, phishing, hacking, social engineering, data breaches, and emerging risks associated with artificial intelligence.
+Added: Our program is regularly assessed using the NIST Cybersecurity Framework, and mandatory information security training is provided to our employees.
Our information security team is empowered to assess and address cybersecurity risks in close collaboration with the operational teams.
6 unchanged sentences
Third-party risks are documented as part of a risk management process that follows an industry standard framework with a goal of remediation or mitigation.
+Added: 20 Service Corporation International
Cybersecurity Threat Risks
6 unchanged sentences
Management’s Role in Managing Cybersecurity Risk
−Removed: The Assistant Vice President, Information Technology Security reports to the Vice President of Information Technology and is responsible for briefing the Audit Committee on information security risks.
−Removed: The AVP, IT Security provides comprehensive briefings to the Audit Committee on a regular basis.
+Added: The Assistant Vice President, Information Technology Security, who also functions as the company's data protection officer, reports to the Vice President of Information Technology and is responsible for briefing the Audit Committee on information security risks.
+Added: The AVP, IT Security provides comprehensive briefings to the Audit Committee on a quarterly basis.
These briefings highlight various cybersecurity topics, including new cybersecurity threats, incidents, risks, risk management solutions, strategy pivots, or proposed governance changes.
−Removed: The Audit Committee actively participates in cybersecurity-related business decisions.
Risk Management Expertise
2 unchanged sentences
The AVP, IT Security is responsible for detecting known and potential cybersecurity incidents, leading cybersecurity incident investigations, and ensuring that cybersecurity incidents are reported timely, promptly escalated and resolved in accordance with the Company cybersecurity incident response plan.
−Removed: The AVP, IT Security is a Certified Information Security Manager (CISM) and his cybersecurity expertise is a valuable resource for Company executive leadership and the Board.
+Added: The AVP, IT Security is a Certified Information Security Manager and his cybersecurity expertise is a valuable resource for Company executive leadership and the Board.
Monitoring Cybersecurity Incidents
19 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.