3 unchanged sentences
Tredegar’s Cybersecurity Program (the “Program”), which was designed utilizing a risk-based approach, was developed to not only prevent, identify, investigate, resolve, and mitigate potential cybersecurity vulnerabilities within Tredegar but also to enhance the information security posture of Tredegar’s operations involving third-party service providers.
−Removed: Tredegar entrusts the third-party service providers with the responsibility to institute security measure protocols that are appropriately and proportionally tailored to the corresponding risks.
−Removed: Additionally, Tredegar also periodically conducts assessments of the third-party service providers’ security frameworks to verify the implementation of adequate security measures, to safeguard Tredegar against potential vulnerabilities.
+Added: Tredegar entrusts its third-party service providers with the responsibility to institute security measure protocols that are appropriately and proportionally tailored to the corresponding risks.
+Added: However, Tredegar also periodically conducts assessments of the third-party service providers’ security frameworks to verify the implementation of adequate security measures, to safeguard Tredegar against potential vulnerabilities.
The Program leverages a blend of automated systems, manual operations, and external evaluations to proactively identify and mitigate potential cybersecurity threats.
Key components of the Program include Tredegar’s Cybersecurity Incident Response Plan and Cyber Crisis Management Plan.
−Removed: These plans encompass a strategic approach that includes detection of threats, thorough analysis of cybersecurity incidents to determine whether timely notification to the Board of Directors is necessary, containment of incidents, eradication or mitigation of threats, recovery processes, and a comprehensive post-incident review.
−Removed: To further strengthen its cybersecurity posture, Tredegar employs third-party consultants who work with the internal audit and information technology (“IT”) departments to assess Tredegar’s information security program and practices, including incident management, service continuity, and information security compliance programs, and identify areas for improvement.
+Added: These plans encompass a strategic approach that includes:
+Added: (i) detection of threats, thorough analysis of cybersecurity incidents to determine whether timely notification to Tredegar’s Board of Directors (“Board”) is necessary;
+Added: (ii) containment of incidents;
+Added: (iii) eradication or mitigation of threats;
+Added: (iv) recovery processes;
+Added: and (v) a comprehensive post-incident review.
+Added: To further strengthen its cybersecurity posture, Tredegar employs third-party consultants who work with the internal audit and information technology (“IT”) functions to assess Tredegar’s information security program and practices, including incident management, service continuity, and information security compliance programs, and identify areas for improvement.
The results of such an assessment are regularly presented to the Audit Committee.
2 unchanged sentences
Additionally, because Tredegar recognizes the significant role that its employees play in information security, it provides annual formal information security training to all of its employees that covers critical topics such as phishing and email security best practices.
−Removed: Tredegar’s IT Director has over 10 years of cybersecurity expertise, including a robust history of similar roles, cybersecurity certifications from EC-Council and ODU Global and holds a degree in Computer Science from Universidade Catolica de Pernambuco and an MBA in IT Management from Universidade Federal de Pernambuco.
−Removed: Our IT Director is responsible for overseeing the Program, including the prevention, mitigation, detection, and remediation of cybersecurity incidents.
−Removed: Tredegar’s IT Director also regularly collaborates closely with key management, including the Chief Financial Officer, General Counsel, Compliance Manager, and Human Resources Executive Director, to foster effective communication within Tredegar.
+Added: Furthermore, periodic simulated phishing exercises are conducted to reinforce these practices.
+Added: Tredegar’s IT Director and Bonnell’s Director of Information Security are responsible for managing the Program, including the prevention, mitigation, detection and remediation of cybersecurity incidents.
+Added: Tredegar’s IT Director has over 10 years of cybersecurity expertise, including working in similar roles at other companies, has cybersecurity certifications from EC-Council and ODU Global and holds a degree in Computer Science from Universidade Catolica de Pernambuco and an MBA in IT Management from Universidade Federal de Pernambuco.
+Added: Bonnell’s Director of Information Security has over 30 years of cybersecurity experience, including working in similar roles at other companies, has cybersecurity certifications from EC-Council and ISC^2 and holds a degree in Mechanical Engineering from the Georgia Institute of Technology.
+Added: Tredegar’s IT Director and Bonnell’s Director of Information Security also regularly collaborate closely with key management, including the Chief Financial Officer, General Counsel, Compliance Manager, and Human Resources Executive Director, to foster effective communication regarding the Program within Tredegar.
The Board is responsible for risk management, with specific oversight of cybersecurity risks being delegated to the Audit Committee.
−Removed: The Audit Committee receives updates from the IT Director at each of its quarterly meetings.
+Added: The Audit Committee receives updates from Tredegar’s and Bonnell’s IT Directors at each of its quarterly meetings.
These updates encompass an assessment of Tredegar’s cybersecurity risk profile, including the efficacy of Tredegar’s cybersecurity policies, procedures, strategies, and areas of emerging risk.
Additionally, the Board receives annual, but often more frequent, updates on Tredegar’s cybersecurity systems.
+Added: Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected us, including our business strategy, results of operations or financial condition.
+Added: Risk Factors for further information.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.