4 unchanged sentences
Our cybersecurity program is built upon the U.S.
−Removed: Department of Commerce's National Institute of Standards and Technology ("NIST") Cybersecurity Framework.
+Added: Department of Commerce’s National Institute of Standards and Technology (“NIST”) Cybersecurity Framework for Information Technology (“IT”) environments, and complemented by the IEC 62443 series of standards for securing Operational Technology (“OT”) and industrial control systems.
+Added: Together, these frameworks provide a structured, risk-based approach to managing cybersecurity across both enterprise and operational domains.
Cybersecurity risk is an integral part of our Enterprise Risk Management (“ERM”) program, which evaluates potential impacts to our operations, financial stability, and reputation.
−Removed: The Vice President of Technical Services serves as the Senior Management sponsor for cybersecurity risk and mitigation plans.
−Removed: Day-to-day management of cybersecurity risks falls under the responsibility of the Director of Information Security and Information Technology ("ISIT") and the Cybersecurity Manager.
−Removed: Our Cybersecurity Manager is a retired U.S.
−Removed: Military Cyber Warfare Officer with over 15 years of experience in Cybersecurity Operations and a member of the International Association of Drilling Contractors Cybersecurity Committee.
+Added: The Executive Vice President, Chief Technology and Sustainability Officer serves as the Senior Management sponsor for cybersecurity risk and mitigation plans.
+Added: Day-to-day management of cybersecurity risks falls under the responsibility of the Director of Information Security and Information Technology ("ISIT").
+Added: Our Director of Information Security is a seasoned cybersecurity and risk management leader with over 20 years of experience directing enterprise-wide security programs and IT governance for Fortune 1000 organizations in the energy sector, specializing in the development of global cybersecurity frameworks and the mitigation of digital risks within complex offshore environments.
The governance of Seadrill’s cybersecurity program is detailed in Directives and Procedures within our Management System.
6 unchanged sentences
To maintain and enhance the strength of our cybersecurity controls while reducing risk exposure, Seadrill conducts vulnerability assessments and penetration testing.
−Removed: As a principal risk, cybersecurity is also included in our rolling Internal Audit & Assurance program and is subject to external ISO 9001 quality management certification, certified by DNV.
+Added: As a principal risk, cybersecurity is also included in our rolling Internal Audit & Assurance program and is subject to external ISO 9001 quality management certification, certified by Det Norske Veritas.
Oversight of these efforts is provided by the Assurance, Quality & Enterprise Risk Function, which ensures the robustness of key mitigations and controls.
1 unchanged sentence
Additionally, cybersecurity risks are reviewed annually as part of the ERM program.
−Removed: The ISIT Function leads ongoing training and awareness initiatives that applies to all Seadrill personnel, including employees, contractors and contingent workers, emphasizing cybersecurity as a critical organizational priority and mitigating the potential human factor in cyber incidents.
+Added: The ISIT Function leads ongoing training and awareness initiatives that apply to all Seadrill personnel, including employees, contractors and contingent workers, emphasizing cybersecurity as a critical organizational priority and mitigating the potential human factor in cyber incidents.
To date, Seadrill’s business strategy, operations, and financial condition have not been materially affected by large-scale cybersecurity threats or incidents.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.