4 unchanged sentences
The Company’s cybersecurity program is designed to protect and preserve the confidentiality, integrity, and availability of our networks and systems, as well as information that we own or is in our care, through a risk-based approach.
−Removed: The Company’s program is based on the U.S.
+Added: The Company’s program may leverage aspects of U.S.
National Institute for Standards and Technology standards and other applicable industry frameworks.
−Removed: Our cybersecurity program identifies, assesses, and manages material risks from cybersecurity threats by implementing a comprehensive set of practices, processes, and technologies designed to protect our data digital assets and data.
+Added: Our cybersecurity program identifies, assesses, and manages material risks from cybersecurity threats by implementing robust practices, processes, and technologies designed to protect our data digital assets and data.
Our cybersecurity program includes:
−Removed: • ongoing employee cybersecurity awareness and training activities, which includes periodic “phishing” testing;
+Added: • annual compliance training, which includes modules on information security, and provides quarterly phishing simulation exercises to reinforce awareness and enhance cybersecurity practices;
• intrusion detection by monitoring network and system activities to detect unusual or suspicious behavior;
9 unchanged sentences
The Company has processes designed to manage cybersecurity risks arising from our use of such vendors, including conducting risk assessments prior to integration into the Company’s networks and additional assessments prior to contract renewals or extensions.
−Removed: Cybersecurity measures employed by significant third-party service providers are also assessed prior to introduction into our environment.
+Added: Cybersecurity measures employed by significant third-party service providers are also further analyzed prior to introduction into our environment.
The Company also commissions third-party risk assessments of certain IT vendors to identify and evaluate risks associated with each third party and to minimize potential disruptions and liabilities that may arise from external partnerships.
13 unchanged sentences
The CISO also leads a cross-functional Cybersecurity Incident Response Team (“CSIRT”) responsible for responding to and managing cybersecurity incidents.
−Removed: The CSIRT consists of professionals from various departments within SEI, including Information Technology, Information Security, Legal, Finance, Enterprise Risk Management, Human Resources, and other key business areas.
+Added: The CSIRT consists of professionals from various
+Added: departments within SEI, including Information Technology, Information Security, Legal, Finance, Enterprise Risk Management, Human Resources, and other key business areas.
The CISO has extensive expertise in cybersecurity, including over two decades of experience at a federal law enforcement agency, where responsibilities included technical risk management, information security, cyber investigations, incident response, and cyber strategy.
−Removed: In addition to the CISO’s professional background, the CISO maintains several relevant industry credentials, including ISACA Certification in Risk and Information Systems Control (“CRISC”) and ISC2 Certification in Information Systems Security Professional (“CISSP”).
+Added: In addition to the CISO’s professional background, the CISO maintains several relevant industry credentials.
The Audit Committee of the Company’s Board of Directors , which is wholly comprised of independent directors, is tasked with oversight of the Company’s enterprise risk assessment and risk management policies and guidelines, including cybersecurity.
1 unchanged sentence
Each update includes, among other topics, a summary of SEI cybersecurity events, vulnerability management, ransomware readiness, and global cybersecurity trends across industries.
−Removed: The Audit Committee also receives updates from Internal Audit, which report on cybersecurity in the context of enterprise risk management.
+Added: The Audit Committee also receives updates from Internal Audit, which may report on cybersecurity in the context of enterprise risk management.
The Audit Committee updates the Board of Directors as appropriate.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.