1 unchanged sentence
Cybersecurity
−Removed: Information technology supports several aspects of our business, including product ordering and fulfillment, pricing, customer service, transaction processing, financial reporting, collections, and cost management.
+Added: Information technology supports a number of our business processes, including product ordering and fulfillment, pricing, customer service, transaction processing, financial reporting, collections, and cost management.
Further, our business operations rely on the secure collection, storage, transmission, and other processing of proprietary, confidential, and sensitive data of the Company and third parties.
Risk Management and Strategy
−Removed: We assess, identify and manage the material risks associated with cybersecurity threats as part of our annual enterprise risk management (“ERM”) program addressing our strategic, operational, compliance and financial risks across the organization.
−Removed: Our ERM program incorporates feedback from senior management, certain functional leaders and third-party service providers.
−Removed: Each identified high-level risk is assigned to a member of senior management as the risk owner for oversight, with the risk owner developing a risk mitigation plan that is tracked to completion.
−Removed: We have prioritized cybersecurity risks and made investments of time and resources in recent years to mitigate this risk area.
+Added: We have prioritized cybersecurity risks and made investments of time and resources to mitigate this risk area.
We have implemented and maintain various technical, physical, and organizational measures, processes, standards, and/or policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data.
−Removed: Our risk mitigation steps include engagements with third-party service providers with expertise in cybersecurity that assist us in assessing risk, including vulnerability assessments and penetration testing, and the implementation of risk mitigation measures.
+Added: Our risk mitigation steps include engagements with third-party service providers with expertise in cybersecurity that assist us in assessing risk, including vulnerability assessments and penetration testing, and the implementation of risk mitigation
We have implemented firewalls (including encryption of data, network security controls, access controls and physical security) across all of our locations and invested in intrusion detection and protection systems, email filtering and systems to mitigate the risk of phishing attacks.
+Added: As part of our cybersecurity program, we conduct mandatory training for employees on how to recognize potential cyber threats and we have communicated reporting procedures for employees to bring any such threats to the immediate attention of our IT security team.
+Added: New hires and employees who join our Company as the result of acquisitions must complete this required training.
+Added: Further, we test employee knowledge of our cybersecurity policies through threat simulations throughout the year.
We maintain a managed detection and response system and a security operations center that operates 24 hours per day, seven days per week.
4 unchanged sentences
As part of this process, we enhanced our security incident response procedures to address risks specific to remote working conditions.
+Added: Further, as we integrate acquired organizations and their information technology systems, we assess potential vulnerabilities to cybersecurity threats and make the investments necessary to mitigate such vulnerabilities.
+Added: As part of our integration process, we apply the same technical, physical and organizational measures, processes, standards and/or policies to the acquired organizations.
Third-party service providers, such as distributors, subcontractors, vendors, and data processors have access to certain portions of our data in supporting various operating business functions.
1 unchanged sentence
Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider, conducting security assessments, and conducting periodic reassessments during their engagement.
+Added: We also assess, identify and manage the material risks associated with cybersecurity threats at the enterprise level as part of our enterprise risk management ("ERM") program addressing our strategic, operational, compliance and financial risks across the organization.
As with most companies, we have experienced cyber-attacks, attempts to breach our systems and other similar incidents.
−Removed: However, risks from cybersecurity threats, including from prior cyber incidents, have not materially affected in 2024, and are not reasonably likely to materially affect in 2025 , our Company, including our business strategy, results of operations or financial condition.
+Added: We expect such incidents to continue as cyber criminals use increasingly sophisticated methods to seek to infiltrate company information technology systems.
+Added: Risks from cybersecurity threats, including from prior cyber incidents, have not materially affected our Company in 2025, including our business strategy, results of operations or financial condition.
We carry cyber risk insurance that provides protection against a breach or other data security incident, but such insurance may not be sufficient, and any related insurance proceeds may not be timely paid to us.
3 unchanged sentences
Governance Oversight
−Removed: Our Board oversees the Company’s cybersecurity program by receiving quarterly reports (or more often, if necessary) from our Chief Executive Officer and our combined Chief Information Officer and Chief Information Security Officer (our “CIO/CISO”) on potential threats (including emerging risks) and any incidents, and the measures we have taken to prevent and to mitigate the impact of cyber-attacks on our systems.
+Added: Our Board oversees the Company’s cybersecurity program by receiving regular reports (or more often, if necessary) from our Chief Executive Officer and our combined Chief Information Officer and Chief Information Security Officer (our “CIO/CISO”) on potential threats (including emerging risks) and any incidents, and the measures we have taken to prevent and to mitigate the impact of cyber-attacks on our systems.
Our Board also reviews the efficacy of our cybersecurity program, the status of key information security initiatives, and approves, as appropriate, reasonable investments to enhance the protection of our information technology systems.
+Added: Our management team and Board conduct simulation exercises to test our level of preparedness to respond to potential cybersecurity threats.
Our executive leadership team , which includes our Chief Executive Officer and CIO/CISO, manages the Company’s efforts to address cybersecurity threats by receiving weekly reports from our CIO/CISO on potential threats, mitigation steps, the sufficiency of cybersecurity resources (including personnel, third party resources, hardware and software), and employee training and communications.
12 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.