8 unchanged sentences
Our information security program is designed to evaluate, identify, and manage risks from cybersecurity threats and vulnerabilities, including malware, phishing, hacking, social engineering, data breaches, and emerging risks associated with artificial intelligence.
−Removed: Our program is regularly assessed using the NIST Cybersecurity Framework, and mandatory information security training is provided to our employees.
+Added: Assessment of risks may include tabletop exercises, control gap analyses, threat modeling, internal or external audits, vulnerability scans, and penetration tests.
+Added: Our program is regularly assessed using the NIST Cybersecurity Framework, and our policies are reviewed periodically to align with current regulatory requirements and the evolving threat landscape.
+Added: Our employees are required to take mandatory information security training.
Our information security team is empowered to assess and address cybersecurity risks in close collaboration with the operational teams.
6 unchanged sentences
Third-party risks are documented as part of a risk management process that follows an industry standard framework with a goal of remediation or mitigation.
−Removed: 20 Service Corporation International
Cybersecurity Threat Risks
6 unchanged sentences
Management’s Role in Managing Cybersecurity Risk
−Removed: The Assistant Vice President, Information Technology Security, who also functions as the company's data protection officer, reports to the Vice President of Information Technology and is responsible for briefing the Audit Committee on information security risks.
+Added: The Assistant Vice President, Information Technology Security (AVP, IT Security), who also functions as the company's data protection officer, reports to the Vice President of Information Technology and is responsible for briefing the Audit Committee on information security risks.
The AVP, IT Security provides comprehensive briefings to the Audit Committee on a quarterly basis.
2 unchanged sentences
With over 24 years of experience working on information technology and cybersecurity teams, the AVP, IT Security is the lead architect of the company’s security infrastructure.
−Removed: In his role, the AVP, IT Security has built and developed effective and lasting information security solutions, establishing a robust framework of technical, administrative and physical controls while providing stakeholders such as executive management, operations leadership and legal counsel clear and constant visibility into rapidly evolving business threats.
+Added: In his role, the AVP, IT Security has built and developed effective and
+Added: lasting information security solutions, establishing a robust framework of technical, administrative and physical controls while providing stakeholders such as executive management, operations leadership and legal counsel clear and constant visibility into rapidly evolving business threats.
The AVP, IT Security is responsible for detecting known and potential cybersecurity incidents, leading cybersecurity incident investigations, and ensuring that cybersecurity incidents are reported timely, promptly escalated and resolved in accordance with the Company cybersecurity incident response plan.
10 unchanged sentences
The AVP, IT Security presents quarterly briefings to the Cyber Security and Data Governance Executive Steering Committee on all issues related to cybersecurity risks and incidents.
−Removed: The Cyber Security and Data Governance Executive Steering Committee includes members from the senior leadership team, such as the Chief Operating Officer, the Senior Vice President of Operations Services and the General Counsel.
+Added: The Cyber Security and Data Governance Executive Steering Committee includes members from the senior leadership team, such as the Chief Financial Officer, the Senior Vice President of Operations Services and the General Counsel.
Our highest levels of management are actively aware and involved in shaping the company’s cybersecurity position and analyzing potential risks.
8 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.