5 unchanged sentences
The Board of Directors (the "Board") has the primary responsibility for oversight of cybersecurity matters.
−Removed: This responsibility had been previously delegated to the Audit Committee.
+Added: The Audit Committee also monitors cybersecurity risk as part of its oversight of financial risk exposures.
The Board regularly reviews compliance and disclosure control procedures for cybersecurity matters.
−Removed: The Board also receives quarterly briefings from members of management responsible for cybersecurity and digital risk management for the Company, including the Vice President and Chief Information Officer (the “CIO”) , Chief Information Security Officer (the “CISO”) and Senior Vice President, General Counsel and Secretary (the “General Counsel”), as well as third-party cybersecurity advisors, on the Company’s cybersecurity program, including data protection and cybersecurity risks and the Company’s new and existing cyber risk controls intended to mitigate them, as appropriate.
−Removed: The Company has protocols and procedures by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Board.
+Added: The Board and Audit Committee also receive regular briefings (at least annually) from members of management responsible for cybersecurity and digital risk management for the Company, including the Vice President and Chief Information Officer (the “CIO”) , Chief Information Security Officer (the “CISO”) and Senior Vice President, General Counsel and Secretary (the “General Counsel”), as well as third-party cybersecurity advisors, on the Company’s cybersecurity program, including data protection and cybersecurity risks and the Company’s new and existing cyber risk controls intended to mitigate them, as appropriate.
+Added: The Company has protocols and procedures by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Audit Committee and the full Board.
At the management level, oversight of risks from cybersecurity threats has been integrated into the Company’s overall risk management processes.
1 unchanged sentence
The Senior Risk Council is comprised of senior management personnel representing different functional and business areas, including the Chief Executive Officer;
−Removed: Chief Operating Officer ("COO");
−Removed: Chief Financial Officer;
+Added: Chief Financial Officer & Chief Administrative Officer ("CFO");
General Counsel;
3 unchanged sentences
The CIO also holds a bachelor’s degree in computer science.
−Removed: The Senior Risk Council meets regularly to discuss the risk management measures implemented by the Company, including measures to identify and mitigate data protection and cybersecurity risks.
+Added: The Senior Risk Council meets regularly to discuss the risk management measures implemented by the Company, including measures to identify and mitigate data protection and cybersecurity risks and the broader cybersecurity risk landscape.
The Senior Risk Council receives regular updates on cybersecurity incidents from the CISO and CIO.
2 unchanged sentences
She also holds a Master of Science degree in Information and Cybersecurity from the University of California, Berkeley.
−Removed: The CISO reports directly to the CIO who in turn reports directly to the COO.
+Added: The CISO reports directly to the CIO who in turn reports directly to the CFO.
The CISO receives reports on cybersecurity threats from members of the Cyber Security Office on an ongoing basis and, in conjunction with the Senior Risk Council, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.
1 unchanged sentence
Internal Cybersecurity Team
−Removed: The Company's Cyber Security Office, led by the CISO, is responsible for the implementation, monitoring, and maintenance of cybersecurity governance, operations and data protection practices across the Company.
+Added: The Company's Cyber Security Office, led by the CISO, is responsible for monitoring, maintaining and supporting the implementation of cybersecurity governance, operations and data protection practices across the Company.
The Information Technology organization, led by the CIO, is responsible for the implementation of cybersecurity technical controls.
Reporting to the CISO are a number of experienced information security directors responsible for various parts of the Company’s business, each of whom is supported by a team of trained cybersecurity professionals.
−Removed: The team also holds a number of industry recognized certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, Certified Information Systems Auditor, Certified Network Defense Architect, Certified Cloud Security Professional, Certified Secure Software Lifecycle Professional, and Certified Ethical Hacker, among others.
+Added: The team also holds a number of industry recognized certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, Certified Information Systems Auditor, Certified Cloud Security Professional, Certified Secure Software Lifecycle Professional, Computer Hacking Forensic Investigator and Certified Ethical Hacker, among others.
In addition to its internal cybersecurity capabilities, the Company also regularly engages assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.
7 unchanged sentences
To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the IRP.
−Removed: Through the ongoing communications among these teams, the CISO, in coordination with the legal department and the Senior Risk Council, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Board when appropriate, as discussed above.
+Added: Through the ongoing communications among these teams, the CISO, in coordination with the legal department and the Senior Risk Council, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Audit Committee and the full Board when appropriate, as discussed above.
In general, the IRP leverages the National Institute of Standards and Technology guidance.
The IRP applies to all Company personnel who provide or deliver technology systems (including employees, contractors and service providers).
−Removed: As part of the Company’s cybersecurity risk management strategy, the Company takes measures to test and improve its cybersecurity program, including reviewing and updating the information technology policies and IRP, engaging independent
−Removed: third-party consultants to conduct regular assessments of its cyber security maturity against industry best practice frameworks and recommend program enhancements, and conducting tabletop exercises.
+Added: As part of the Company’s cybersecurity risk management strategy, the Company takes measures to test and improve its cybersecurity program, including reviewing and updating the information technology policies and IRP, engaging independent third-party consultants to conduct regular assessments of its cyber security maturity against industry best practice frameworks and recommend program enhancements, and conducting tabletop exercises.
The Company also engages in internal and external audits to meet its regulatory obligations or customer requirements.
−Removed: The assessment summaries and action plans are shared with the Board as part of the regular briefings provided by the CIO and CISO.
+Added: The assessment summaries and action plans are shared with the Audit Committee as part of the regular briefings provided by the CIO and CISO, and in turn the Audit Committee Chair regularly updates the full Board on such briefings.
The Company has processes and procedures as part of its centralized supplier risk management system to oversee, identify, assess and reduce cybersecurity threats and risks associated with key third-party service providers.
As part of this process, the Company utilizes external frameworks and tools to provide assessment scoring, planning and monitoring against cybersecurity threats and risks and remediation recommendations, as applicable.
−Removed: Updates on third-party service provider risks are included in regular briefings to the Senior Risk Council by the CISO and CIO and escalated to the Board as appropriate.
+Added: Updates on third-party service provider risks are included in regular briefings to the Senior Risk Council by the CISO and CIO and escalated to the Audit Committee and the full Board as appropriate.
Cybersecurity Risks, Threats & Incidents
2 unchanged sentences
The Company deploys measures which it believes leverage industry accepted frameworks to deter, prevent, detect, respond to, and mitigate these threats.
−Removed: The Company has invested and continues to invest in risk management and information security and data privacy measures it believes are appropriate to protect its systems and data, including employee and critical service provider training, organizational investments, incident response plans, tabletop exercises and technical defenses.
+Added: The Company has invested and continues to invest in risk management and information security and data protection measures it believes are appropriate to protect its systems and data, including employee and critical service provider training, organizational investments, incident response plans, tabletop exercises and technical defenses.
Despite these efforts, cybersecurity incidents (against the Company or parties with whom the Company contracts), depending on their nature and scope, could potentially result in the misappropriation, disclosure, destruction, corruption or unavailability of critical data and confidential or proprietary information (the Company's or that of third parties) and the disruption of business operations.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.