1 unchanged sentence
CYBERSECURITY
−Removed: The Company has implemented a comprehensive cybersecurity program to assess, identify and manage risks from cybersecurity threats that may result in adverse effects to the confidentiality, integrity, and availability of its information systems and oversee compliance with applicable regulatory, operational, and contractual requirements.
+Added: The Company has a comprehensive cybersecurity program to assess, identify and manage risks from cybersecurity threats that may result in adverse effects to the confidentiality, integrity, and availability of its information systems and oversee compliance with applicable regulatory, operational, and contractual requirements.
Cyber Incident Response Team and Governance
Board of Directors
−Removed: The Board has delegated the primary responsibility for oversight of cybersecurity matters to the Audit Committee.
−Removed: The Audit Committee regularly reviews compliance and disclosure control procedures for cybersecurity matters.
−Removed: Members of management responsible for cybersecurity and digital risk management for the Company, including the Vice President and Chief Information
−Removed: Officer (the “CIO”), Chief Information Security Officer (the “CISO”) and the Senior Vice President, General Counsel and Secretary (the “General Counsel”), provide regular updates to the Audit Committee regarding data protection and cybersecurity risks and the Company’s new and existing cyber risk controls intended to mitigate them.
−Removed: The Audit Committee regularly briefs the full Board on these matters, and the full Board also receives briefings from management and third-party cybersecurity advisors on the Company’s cybersecurity program, as appropriate.
−Removed: The Company has protocols and procedures by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Audit Committee and the full Board.
+Added: The Board of Directors (the "Board") has the primary responsibility for oversight of cybersecurity matters.
+Added: This responsibility had been previously delegated to the Audit Committee.
+Added: The Board regularly reviews compliance and disclosure control procedures for cybersecurity matters.
+Added: The Board also receives quarterly briefings from members of management responsible for cybersecurity and digital risk management for the Company, including the Vice President and Chief Information Officer (the “CIO”) , Chief Information Security Officer (the “CISO”) and Senior Vice President, General Counsel and Secretary (the “General Counsel”), as well as third-party cybersecurity advisors, on the Company’s cybersecurity program, including data protection and cybersecurity risks and the Company’s new and existing cyber risk controls intended to mitigate them, as appropriate.
+Added: The Company has protocols and procedures by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Board.
At the management level, oversight of risks from cybersecurity threats has been integrated into the Company’s overall risk management processes.
1 unchanged sentence
The Senior Risk Council is comprised of senior management personnel representing different functional and business areas, including the Chief Executive Officer;
+Added: Chief Operating Officer ("COO");
Chief Financial Officer;
1 unchanged sentence
and CIO, as well as other senior business leaders.
−Removed: The Company believes the experience that Senior Risk Council members have from serving on the Senior Risk Council provides them with an understanding of the Company’s risk management process overall, and individual members are able to provide further insight to the risk analysis process based on their functional area of expertise within the business.
+Added: The Company believes the experience that these senior management personnel have from serving on the Senior Risk Council provides them with an understanding of the Company’s risk management processes overall, and individual members are able to provide further insight to the risk analysis process based on their functional area of expertise within the business.
The CIO also has extensive leadership experience in computer product engineering and information technology fields, including responsibility for overseeing cybersecurity risk management and digital risk management.
2 unchanged sentences
The Senior Risk Council receives regular updates on cybersecurity incidents from the CISO and CIO.
−Removed: The Company’s CISO is the member of management principally responsible for overseeing the Company’s cybersecurity risk management program, in coordination with the CIO and other business leaders across the Company, including legal, product engineering management, internal audit, finance and risk management.
+Added: The Company’s CISO is the member of management principally responsible for overseeing the Company’s cybersecurity risk management program, under the CIO's leadership and in coordination with other business leaders across the Company, including legal, product engineering management, internal audit, finance and risk management.
The CISO has extensive cybersecurity knowledge and skills gained from over 20 years of technical and business experience in the cybersecurity and information security fields, including as a Chief Information Security Officer and through other leadership and technical roles in IT governance and strategy, security risk and compliance, corporate product security and data privacy, and IT infrastructure.
She also holds a Master of Science degree in Information and Cybersecurity from the University of California, Berkeley.
−Removed: The CISO reports directly to the CIO who in turn reports directly to the Chief Executive Officer.
+Added: The CISO reports directly to the CIO who in turn reports directly to the COO.
The CISO receives reports on cybersecurity threats from members of the Cyber Security Office on an ongoing basis and, in conjunction with the Senior Risk Council, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.
2 unchanged sentences
The Company's Cyber Security Office, led by the CISO, is responsible for the implementation, monitoring, and maintenance of cybersecurity governance, operations and data protection practices across the Company.
+Added: The Information Technology organization, led by the CIO, is responsible for the implementation of cybersecurity technical controls.
Reporting to the CISO are a number of experienced information security directors responsible for various parts of the Company’s business, each of whom is supported by a team of trained cybersecurity professionals.
−Removed: The team also holds a number of industry recognized certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, and Certified Ethical Hacker, among others.
+Added: The team also holds a number of industry recognized certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, Certified Information Systems Auditor, Certified Network Defense Architect, Certified Cloud Security Professional, Certified Secure Software Lifecycle Professional, and Certified Ethical Hacker, among others.
In addition to its internal cybersecurity capabilities, the Company also regularly engages assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.
7 unchanged sentences
To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the IRP.
−Removed: Through the ongoing communications among these teams, the CISO, in coordination with the legal department and the Senior Risk Council, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Board and the Audit Committee when appropriate, as discussed above.
+Added: Through the ongoing communications among these teams, the CISO, in coordination with the legal department and the Senior Risk Council, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Board when appropriate, as discussed above.
In general, the IRP leverages the National Institute of Standards and Technology guidance.
−Removed: The IRP applies to all Company personnel who provide or deliver technology systems (including employees or contractors and service providers).
−Removed: As part of the Company’s cybersecurity risk management strategy, the Company takes measures to test and improve its cybersecurity program, including reviewing and updating the information technology policies and IRP, such as engaging an independent third party to conduct regular assessments of its cyber security maturity against industry best practice frameworks and conducting tabletop exercises.
+Added: The IRP applies to all Company personnel who provide or deliver technology systems (including employees, contractors and service providers).
+Added: As part of the Company’s cybersecurity risk management strategy, the Company takes measures to test and improve its cybersecurity program, including reviewing and updating the information technology policies and IRP, engaging independent
+Added: third-party consultants to conduct regular assessments of its cyber security maturity against industry best practice frameworks and recommend program enhancements, and conducting tabletop exercises.
The Company also engages in internal and external audits to meet its regulatory obligations or customer requirements.
−Removed: The assessment summaries and action plans are shared with the Audit Committee as part of the CISO’s regular briefings, and in turn the Audit Committee Chair regularly updates the Board on such briefings.
+Added: The assessment summaries and action plans are shared with the Board as part of the regular briefings provided by the CIO and CISO.
The Company has processes and procedures as part of its centralized supplier risk management system to oversee, identify, assess and reduce cybersecurity threats and risks associated with key third-party service providers.
As part of this process, the Company utilizes external frameworks and tools to provide assessment scoring, planning and monitoring against cybersecurity threats and risks and remediation recommendations, as applicable.
−Removed: Updates on third-party service provider risks are included in regular briefings to the Senior Risk Council by the CISO and CIO and escalated to the Audit Committee as appropriate.
+Added: Updates on third-party service provider risks are included in regular briefings to the Senior Risk Council by the CISO and CIO and escalated to the Board as appropriate.
Cybersecurity Risks, Threats & Incidents
Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition, and the Company does not believe that such risks are reasonably likely to have such an effect over the long term.
−Removed: The Company deploys measures which leverage industry accepted frameworks to deter, prevent, detect, respond to, and mitigate these threats.
−Removed: The Company has invested and continues to invest in risk management and information security and data privacy measures in order to protect its systems and data, including employee and critical service provider training, organizational investments, incident response plans, tabletop exercises and technical defenses.
+Added: As of the date of this report, the Company has not experienced a cybersecurity incident or third-party information security breach in the last three fiscal years that has materially affected the Company, including its business strategy, results of operations or financial condition.
+Added: The Company deploys measures which it believes leverage industry accepted frameworks to deter, prevent, detect, respond to, and mitigate these threats.
+Added: The Company has invested and continues to invest in risk management and information security and data privacy measures it believes are appropriate to protect its systems and data, including employee and critical service provider training, organizational investments, incident response plans, tabletop exercises and technical defenses.
Despite these efforts, cybersecurity incidents (against the Company or parties with whom the Company contracts), depending on their nature and scope, could potentially result in the misappropriation, disclosure, destruction, corruption or unavailability of critical data and confidential or proprietary information (the Company's or that of third parties) and the disruption of business operations.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.