5 unchanged sentences
Our program is integrated into, and cybersecurity risks are among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives.
−Removed: Our cybersecurity risk management program is led by our Vice President of Information Security, who manages our security team that is principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents.
+Added: Our cybersecurity risk management program is led by our Senior Vice President and Chief Information Security Officer ( “ CISO ” ), who manages our security team that is principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents.
Our program includes protocols for preventing, detecting and responding to cybersecurity incidents;
7 unchanged sentences
• assessments of and improvements to, among others, disaster recovery testing, access control, remote access, personnel security, system and communications protection, media protection, change management, data backup and recovery, audit logging, vulnerability and patch management, physical security, configuration management;
+Added: Index to Financial Statements
• periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with various aspects of our cybersecurity processes and controls;
• regular assessments of the design and operational effectiveness of the program’s key processes and controls by our internal audit team with the assistance of external consultants.
−Removed: Index to Financial Statements
We also have a cybersecurity incident response plan for the CIRT to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Board.
5 unchanged sentences
Our Board has primary responsibility for oversight of our cybersecurity and other information technology risks, including our plans to mitigate cybersecurity risks and to respond to data breaches.
−Removed: The Board receives regular reports from our Chief Information Officer (“CIO”) on cybersecurity matters.
+Added: The Board receives regular reports from our CISO on cybersecurity matters.
These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems.
2 unchanged sentences
In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board’s continuing education and overall risk oversight.
−Removed: At the management level, our VP of Information Security leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats.
−Removed: In performing his role, our VP is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management program and other processes described above, including the maintenance and execution of our cyber incident response plan.
−Removed: Our VP reports to our CIO who, in turn, reports directly to our CEO.
−Removed: Our CIO and our VP of Information Security are both experienced cybersecurity executives.
−Removed: Our CIO has nearly 30 years of experience and has held a variety of senior information technology leadership roles at multiple Fortune 500 organizations.
−Removed: Our VP has more more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams.
+Added: At the management level, our CISO leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats.
+Added: In performing this role, our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management program and other processes described above, including the maintenance and execution of our cyber incident response plan.
+Added: Our CISO reports directly to our CFO.
+Added: Our CISO is an experienced cybersecurity executive with more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams.
Members of our security team also hold industry-recognized cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.