2 unchanged sentences
Cybersecurity Risk Management and Strategy
−Removed: At STERIS, the enterprise risk management (“ERM”) program is designed to identify, assess, and manage risks across STERIS’s enterprise.
+Added: At STERIS, the ERM program is designed to identify, assess, and manage risks across STERIS’s enterprise.
Cybersecurity risk management is integrated into STERIS’s ERM program , under which we regularly assess cybersecurity risks in accordance with what we believe are industry cybersecurity best practices.
3 unchanged sentences
We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cybersecurity issues.
−Removed: STERIS has an Executive Cybersecurity Steering Committee consisting of the Senior Vice President & Chief Financial Officer, the Vice President, Chief Accounting Officer, the Vice President, Investor Relations & Corporate Communications, the Vice President & Chief Information Officer (“CIO”), the Vice President, Chief Compliance Officer, the Senior Vice President, General Counsel & Company Secretary, and the Chief Information Security Officer (“CISO”) that is responsible for providing governance, risk and compliance oversight for STERIS’s incident response program, providing guidance and support for cybersecurity non-technical initiatives, and for verifying that appropriate actions are taken following an incident occurrence.
+Added: STERIS has an Executive Cybersecurity Steering Committee consisting of the Senior Vice President & Chief Financial Officer, the Vice President, Chief Accounting Officer, the Vice President, Investor Relations & Corporate Communications, the Vice President & Chief Information Officer (“CIO”), the Vice President, Chief Compliance Officer, the Senior Vice President, General Counsel & Company Secretary, and the Vice President, Chief Information Security Officer (“CISO”) that is responsible for providing governance, risk and compliance oversight for STERIS’s incident response program, providing guidance and support for cybersecurity non-technical initiatives, and for verifying that appropriate actions are taken following an incident occurrence.
We have adopted and maintain an incident response policy that covers our incident response program and the duties and responsibilities of our Incident Response Team (“IRT”) responsible for managing and responding to cybersecurity incidents, including data breaches.
5 unchanged sentences
Our program includes regular vulnerability and penetration testing (internal and external) of our enterprise systems by independent external security experts.
−Removed: Education and awareness training on information security and data protection is conducted regularly for Associates.
+Added: Education and awareness training on information security and data protection is conducted regularly for employees.
Members of the IRT, the Executive Cybersecurity Steering Committee and the Board of Directors receive additional training on responding to cybersecurity incidents.
3 unchanged sentences
Our cybersecurity program for our information systems is directed by our CIO and, with the cybersecurity team, our CIO monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents.
+Added: Our CIO has a Bachelor of Science in Computer Engineering, a Master of Business Administration, and over 35 years of experience working in the information technology field, including approximately 20 years of CIO positions.
Our CISO is CISSP-ISSMP and CISM certified and is part of a team of experienced information system security professionals with diverse certifications, including CISSP, CISM, CNSS, CEH, CySA+, CompTIA - Security+, CySA+, PenTest+, and CASP+ and others.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.