3 unchanged sentences
The Company has practices and procedures designed to proactively and comprehensively manage risks from cybersecurity threats.
−Removed: These processes are integrated into the Company’s overall enterprise risk management, as overseen by the Company’s board of directors (the “Board”), primarily through its committees, with its Audit Committee having direct oversight over cybersecurity matters.
+Added: These processes are integrated into the Company’s overall enterprise risk management ("ERM"), which establishes a risk management framework that seeks to identify, assess, and manage risks across our business.
+Added: ERM is overseen by the Company’s board of directors (the "Board"), primarily through its committees, with its Audit Committee having direct oversight over cybersecurity matters.
We identify and assess cybersecurity risk through various technologies, processes and policies that are regularly updated to align with the changing threat landscape, evolving business needs, as well as global regulatory requirements.
10 unchanged sentences
The Audit Committee regularly receives reports from our Chief Information Security Officer ("CISO"), Chief Information and Digital Officer ("CIO") and other members of management on cybersecurity threat risk management, including security posture improvements, results from third-party assessments, identified risks and progress towards risk-mitigation-related goals.
−Removed: The full Board receives a report from our CISO and other members of management annually.
+Added: The full Board receives a report from our CISO and other members of management on cybersecurity at least annually.
Our cybersecurity risk management and strategy processes are led by our CISO .
−Removed: The CISO works closely with the CIO, Chief Privacy Officer, and members of the legal team who report to the Chief Legal Affairs Officer to periodically review the cybersecurity program.
+Added: The CISO works closely with the CIO, Chief Privacy Officer, and members of the legal team who report to the Chief Corporate & Legal Affairs Officer to periodically review the cybersecurity program.
The CISO has over 25 years of experience in cybersecurity, risk management, and compliance, and has served as the chief information security officer at other organizations.
The Company’s CISO oversees the Company’s cybersecurity incident response plan and related processes that are designed to assess and manage material risks from cybersecurity threats.
−Removed: The Company’s CISO also coordinates with the Company’s Legal Affairs team and third parties, such as consultants and legal advisors, to assess and manage material risks from cybersecurity threats.
+Added: The Company’s CISO also coordinates with the Company’s Corporate & Legal Affairs team and third parties, such as consultants and legal advisors, to assess and manage material risks from cybersecurity threats.
The Company’s CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents pursuant to criteria set forth in the Company’s incident response plan and related processes.
Our Disclosure Committee, with the assistance of its Cybersecurity Subcommittee, is responsible for overseeing the establishment and effectiveness of controls and procedures related to the public disclosure of material cybersecurity matters.
−Removed: The Cybersecurity Subcommittee of the Disclosure Committee is comprised of the Controller and Chief Accounting Officer, Treasurer, Chief Legal Affairs Officer, Assistant Secretary, General Auditor, as well as the CISO, CIO and Chief Privacy
+Added: The Cybersecurity Subcommittee of the Disclosure Committee is comprised of the Controller and Chief Accounting Officer, Treasurer, Chief Corporate & Legal Affairs Officer, Assistant Secretary, General Auditor, as well as the CISO, CIO and Chief Privacy Officer.
The Cybersecurity Subcommittee receives, at least every quarter, a report from CISO on cybersecurity incidents and their mitigation, and remediation pursuant to incident response plan and related processes, as well as other relevant cybersecurity risk topics.
As of the date of this Form 10-K, the Company is not aware of any risks from cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.
+Added: Despite our cybersecurity program, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that may materially affect us.
For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor of the section entitled "Item 1A.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.