1 unchanged sentence
Cybersecurity
−Removed: Information technology supports several aspects of our business, including among others, product ordering and fulfillment, pricing, customer service, transaction processing, financial reporting, collections, and cost management.
+Added: Information technology supports several aspects of our business, including product ordering and fulfillment, pricing, customer service, transaction processing, financial reporting, collections, and cost management.
Further, our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data of the Company and third parties.
Risk Management and Strategy
−Removed: We assess, identify and manage the material risks associated with cybersecurity threats as part of our enterprise risk management (“ERM”) program addressing our strategic, operational, compliance and financial risks across the organization.
−Removed: Our ERM program includes feedback from senior management and certain functional leaders.
−Removed: Each high-level risk is assigned to a member of senior management as the risk owner for oversight, with the risk owner developing a risk mitigation plan that is tracked to completion.
+Added: We assess, identify and manage the material risks associated with cybersecurity threats as part of our annual enterprise risk management (“ERM”) program addressing our strategic, operational, compliance and financial risks across the organization.
+Added: Our ERM program incorporates feedback from senior management, certain functional leaders and third-party service providers.
+Added: Each identified high-level risk is assigned to a member of senior management as the risk owner for oversight, with the risk owner developing a risk mitigation plan that is tracked to completion.
We have prioritized cybersecurity risks and made investments of time and resources in recent years to mitigate this risk area.
2 unchanged sentences
We have implemented firewalls (including encryption of data, network security controls, access controls and physical security) across all of our locations and invested in intrusion detection and protection systems, email filtering and systems to mitigate the risk of phishing attacks.
−Removed: We maintain a managed detection and response system and a security operations center that operates 24 hours per day, 7 days per week.
+Added: We maintain a managed detection and response system and a security operations center that operates 24 hours per day, seven days per week.
Further, we have prepared an incident response plan to activate in the event of a cybersecurity event, including to respond to any such incident, define and seek to control the extent of the incident (including using an escalation framework based on the materiality of incidents), assess and take reasonable actions intended to remediate any damage caused, and implement measures designed to prevent future reoccurrences.
7 unchanged sentences
As with most companies, we have experienced cyber-attacks, attempts to breach our systems and other similar incidents.
−Removed: However, risks from cybersecurity threats, including from prior cyber incidents, have not materially affected, or are not reasonably likely to materially affect, our Company, including our business strategy, results of operations or financial condition in 2023 and recent years We carry cyber risk insurance that provides protection against a breach or other data security incident, but such insurance may not be sufficient, and any related insurance proceeds may not be timely paid to us.
+Added: However, risks from cybersecurity threats, including from prior cyber incidents, have not materially affected in 2024, and are not reasonably likely to materially affect in 2025 , our Company, including our business strategy, results of operations or financial condition.
+Added: We carry cyber risk insurance that provides protection against a breach or other data security incident, but such insurance may not be sufficient, and any related insurance proceeds may not be timely paid to us.
See “Risk Factors — Risks Related to Our Operations and Industry — We rely on information technology systems to support our business operations.
−Removed: A significant disturbance or breach of our technological infrastructure could adversely affect our financial condition and results of operations.
+Added: A significant disturbance or breach of our technological infrastructure could adversely affect our business, financial condition and results of operations.
Additionally, failure to maintain the security of confidential information could damage our reputation and expose us to litigation,” for additional discussion about cybersecurity-related risks.
Governance Oversight
−Removed: Our Board of Directors oversees the Company’s cybersecurity program by receiving quarterly reports (or more often, if necessary) from management on potential threats (including emerging risks) and any incidents, and the measures we have taken to prevent and to mitigate the impact of cyber attacks on our systems.
−Removed: Our management presenters includes our Chief Executive Officer and our combined Chief Information Officer and Chief Information Security Officer (our “CIO/CISO”).
+Added: Our Board oversees the Company’s cybersecurity program by receiving quarterly reports (or more often, if necessary) from our Chief Executive Officer and our combined Chief Information Officer and Chief Information Security Officer (our “CIO/CISO”) on potential threats (including emerging risks) and any incidents, and the measures we have taken to prevent and to mitigate the impact of cyber-attacks on our systems.
Our Board also reviews the efficacy of our cybersecurity program, the status of key information security initiatives, and approves, as appropriate, reasonable investments to enhance the protection of our information technology systems.
Our executive leadership team , which includes our Chief Executive Officer and CIO/CISO, manages the Company’s efforts to address cybersecurity threats by receiving weekly reports from our CIO/CISO on potential threats, mitigation steps, the sufficiency of cybersecurity resources (including personnel, third party resources, hardware and software), and employee training and communications.
−Removed: Our CIO/CISO is a direct report of our Chief Executive Officer Our CIO/CISO has 25 years of experience, including serving in similar roles leading and overseeing cybersecurity and information technology programs.
+Added: Our CIO/CISO is a direct report of our Chief Executive Officer.
+Added: Our CIO/CISO has over 25 years of experience, including serving in similar roles leading and overseeing cybersecurity and information technology programs.
He has the following educational qualifications in the cybersecurity field:
1 unchanged sentence
He also has been certified in matters relevant to cybersecurity risk management as follows:
−Removed: certified information systems auditor (CISA);
−Removed: certified information systems security professional (CISSP);
−Removed: certified data privacy solutions professional (CDPSE);
+Added: certified information systems auditor;
+Added: certified information systems security professional;
+Added: certified data privacy solutions professional;
and certified in risk information systems and controls (CRISC).
−Removed: IT team members that support our CIO/CISO and our information security program have relevant educational and industry experience.
−Removed: Our executive leadership team further includes several executives with prior experience in information technology systems, including potential cybersecurity, data privacy regulation, enterprise risk management, assessment and auditing of internal controls related to data security.
+Added: The members of our IT security function that support our CIO/CISO and our information security program also have relevant educational and industry experience.
+Added: Our executive leadership team further includes several executives with prior experience in information technology systems, including cybersecurity, data privacy regulation, enterprise risk management, assessment and auditing of internal controls related to data security.
Our incident response plan is led by our CIO/CISO and includes a multidisciplinary team, including members of our IT security function, executive management of our legal, finance, human resources, corporate communications and internal audit/risk functions.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.