12 unchanged sentences
Incidents are evaluated to determine materiality as well as operational and business impact and reviewed for privacy impact.
−Removed: Our cybersecurity risk management program leverages the National Institute of Standards and Technology framework, which organizes cybersecurity risks into five categories:
−Removed: identify, protect, detect, respond and recover.
+Added: Our cybersecurity risk management program leverages the National Institute of Standards and Technology framework, which organizes cybersecurity risks into six categories:
+Added: identify, protect, detect, respond, recover and govern.
In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media and email.
3 unchanged sentences
At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation.
−Removed: The team also prepares a monthly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment.
+Added: The team also prepares a quarterly cyber scorecard, regularly collects data on cybersecurity threats and risk areas and conducts an annual risk assessment.
Further, we conduct periodic external penetration tests, red team testing and maturity testing to assess our processes and procedures and the threat landscape.
These tests and assessments are useful tools for maintaining a robust cybersecurity program to protect our investors, customers, employees, vendors, and intellectual property.
−Removed: In the event of an incident, we have outside cybersecurity legal counsel who would consult and coordinate with other third parties in the, including communication and notification to third-parties as required;
+Added: In the event of an incident, we have outside cybersecurity legal counsel who would consult and coordinate with other third parties involved in the incident, including communication and notification to third-parties as required ;
cybersecurity vendors that would perform various investigation services as well as assisting with the recovery and restoration of any impacted IT System services;
5 unchanged sentences
Such individuals have decades of experience in various roles involving information technology, including security, auditing, compliance, systems and programming.
−Removed: These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through
−Removed: their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our crisis response plan, and report to the Risk Committee on any appropriate items.
+Added: These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our crisis response plan, and report to the Risk Committee on any appropriate items.
Under its committee charter, the Risk Committee of our Board of Directors oversees our cybersecurity strategy, reviews our cybersecurity and other information technology risks, controls and procedures, and receives periodic updates from management regarding the adequacy and effectiveness of our cybersecurity measures.
9 unchanged sentences
Legal Proceedings
−Removed: We are periodically party to legal proceedings which arise in the ordinary course of business.
−Removed: Currently, we are not involved in any legal proceedings which we believe could have a material adverse effect on our business or results of operation.
−Removed: Mine Safety Disclosures - Not applicable.
+Added: We are party to legal proceedings which arise in the ordinary course of business.
+Added: We believe that the outcome of such matters, individually and in the aggregate, will not have a material adverse effect on our consolidated financial position.
+Added: Mine Safety Disclosures
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.