15 unchanged sentences
Our service providers are contractually required to notify us promptly of actual or reasonably suspected information security incidents occurring on their systems that may affect our systems or data, including personal information.
−Removed: Should a security breach or incident occur, the Chief Information Officer (the “CIO”) in collaboration with the Company’s General Counsel, Chief Accounting Officer (the “CAO”) and Chief Operating Officer (the “COO”) will evaluate the materiality of any specific incident.
+Added: Should a security breach or incident occur, the Chief Information Officer (the “CIO”) in collaboration with the Company’s General Counsel and Chief Accounting Officer (the “CAO”) will evaluate the materiality of any specific incident.
The Company’s Chief Executive Officer (the “CEO”) and Chief Financial Officer (the “CFO”) will ultimately decide if an incident is material.
−Removed: Considerations of materiality will include a variety of factors, including, for
−Removed: Table of Conten t s
−Removed: example, the extent of expected financial cost, customers impacted, operational impacts, and/or data exposed or lost as a result of the incident.
+Added: Considerations of materiality will include a variety of factors, including, for example, the extent of expected financial cost, customers impacted, operational impacts, and/or data exposed or lost as a result of the incident.
The Information Security Program is intended to provide effective governance and oversight for assessing cybersecurity risks, recognizing that no program, no matter how well designed and implemented, can prevent all potential cybersecurity risks and that the benefits of any potential controls or mitigations should be considered in relation to their costs.
10 unchanged sentences
In addition, we have established a Security Steering Committee that provides guidance and direction to the CIO regarding the Information Security Program, including approval of the Program mission and its objectives.
−Removed: The Security Steering Committee meets at least quarterly and its membership includes, at a minimum, the Director of Information Security, the CIO, the COO, the CFO, the Sr.
+Added: The Security Steering Committee meets regularly and its membership includes, at a minimum, the Director of Information Security, the CIO, the CFO, the Sr.
Vice President of Engineering and Operations, the VP of Legal/General Counsel and the CEO.
Information security risks are reviewed with the Security Steering Committee periodically or as needed.
−Removed: The CIO, in connection with the General Counsel and CEO, updates the Audit Committee periodically on cybersecurity and other information technology risks and opportunities.
−Removed: Additionally, the Audit Committee, with guidance from the CIO, General Counsel and CEO, provides updates to the Board of Directors on the Information Security Program at least annually.
+Added: The CIO, in connection with the General Counsel and CEO, updates the Audit Committee regularly on cybersecurity and other information technology risks and opportunities.
+Added: Additionally, the CIO with guidance from General Counsel and CEO, provides updates to the Board of Directors on the Information Security Program at least annually.
In the case of an information security incident or breach, the Director of Information Security and CIO will follow the Company’s Incident Response Plan and follow communication protocols within the plan, which, depending on the severity of the incident, include escalation timelines and responsibilities that involve updating the Audit Committee and the Board of Directors, as applicable.
−Removed: Table of Conten t s
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.