3 unchanged sentences
Assess, Identify and Manage Material Risks from Cybersecurity Threats
−Removed: Interface has integrated cybersecurity risk management into our broader enterprise risk management framework.
−Removed: This integration ensures that cybersecurity considerations are an integral part of our entity-level risk assessment and decision-making process.
−Removed: Cybersecurity risk management is also a vital part our IT incident management and disaster recovery policy that outlines a systematic approach of implementing and executing strategies and procedures to enable the recovery and restoration of vital business functions and IT infrastructure following a significant disruptive event.
+Added: Interface has implemented processes designed to identify, assess, and manage material risks from cybersecurity threats.
+Added: These processes are integrated into our broader enterprise risk management framework and are intended to enable ongoing evaluation of cybersecurity risks that could impact our business, operations, or financial condition.
+Added: They include activities aimed at protecting sensitive and personal data from unauthorized access, disclosure, or misuse.
+Added: Cybersecurity risks are assessed through a combination of internal evaluations, risk assessments, and monitoring of the evolving threat environment.
+Added: Identified risks are prioritized based on their potential impact and likelihood, and management develops and implements risk mitigation strategies accordingly.
+Added: Use of Cybersecurity Frameworks and Standards
+Added: Our cybersecurity program is informed by recognized industry frameworks and standards.
+Added: Interface currently uses the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to guide its cybersecurity activities, capabilities, and reporting to management and the Board of Directors.
+Added: We also periodically evaluate additional frameworks and standards, including International Organization for Standardization (ISO) 27001, as part of our ongoing efforts to strengthen our cybersecurity governance and risk management practices.
Engagement of Third Parties
−Removed: Interface engages a range of external experts in evaluating and testing our cybersecurity risk management systems.
−Removed: These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices.
−Removed: In the event of a cybersecurity incident, the Company uses external experts to assist with an investigation of the incident, an evaluation of the extent to which the cybersecurity event has impacted the Company’s operations, financial condition, and IT infrastructure, and the recovery and restoration following the incident.
−Removed: We evaluate the inherent risk associated with using external experts by conducting thorough security assessments before engagement and perform ongoing monitoring to ensure compliance with our cybersecurity standards.
−Removed: Governance and Oversight
−Removed: The Audit Committee has oversight responsibility for cybersecurity risk management.
−Removed: The Audit Committee is comprised of board members with diverse experience and expertise to effectively oversee risk, although none of them are cybersecurity experts.
−Removed: Our Chief Information Officer, in his capacity, regularly informs the Audit Committee (typically twice per year) and the full board (typically once per year) on all aspects related to cybersecurity risks, as well as any remediation efforts in response to a cybersecurity incident.
−Removed: Risks from Cybersecurity Threats
−Removed: Our IT systems face a myriad of cybersecurity threats, including, without limitation, hacking, computer viruses, denial of service attacks, malware, ransomware, phishing scams, compromised or irretrievable backups, and other cyber attacks.
−Removed: Any of these events which deny us use of vital IT systems may seriously disrupt our normal business operations and lead to production or shipping stoppages, revenue loss, and reputational harm.
−Removed: To the extent our IT systems store sensitive data, including data related to customers, employees or other parties, risks from cybersecurity threats may expose us to fines and other liabilities, and reputational harm if such data is misappropriated.
−Removed: In addition, as cybercriminals continue to become more sophisticated and numerous, the costs to defend and insure against cyberattacks can be expected to rise.
+Added: Interface's cybersecurity risk management processes include consideration of risks associated with third-party service providers, suppliers, and other business partners.
+Added: We evaluate cybersecurity risks associated with third parties in connection with onboarding and, where appropriate, through periodic reassessments.
+Added: These processes may include contractual requirements, risk assessments, and other measures designed to address cybersecurity risks arising from third-party relationships.
+Added: Cybersecurity Incident Management
+Added: Interface maintains an incident response program designed to identify, respond to, and recover from cybersecurity incidents in a timely manner.
+Added: This program includes defined procedures and thresholds for incident escalation, internal coordination, and communication with relevant stakeholders.
+Added: In the event of a material cybersecurity incident, the Company would assess the incident's impact and make disclosures as required by applicable laws and regulations.
On November 20, 2022, we discovered a cybersecurity attack, perpetrated by unauthorized third parties, affecting our IT systems.
2 unchanged sentences
A more detailed discussion of the Cyber Event can be found in Item 7 entitled “Management’s Discussion and Analysis of Financial Condition and Results of Operations” of this Annual Report on Form 10-K.
+Added: Based upon the information that we have as of the end of the year covered by this Annual Report, we do not believe that any risks from cybersecurity threats, including the Cyber Event described above, have materially affected Interface, including our business strategy, results of operations, or financial condition.
+Added: However, cybersecurity threats are evolving and increasing in sophistication, and the preventative actions we have taken, and continue to take, to reduce the risk of cybersecurity threats and incidents may not successfully protect against all such threats and incidents, and, as a result, there can be no assurance that we or the third parties we interact with will not experience a cybersecurity event in the future that will materially affect the Company, including its business strategy, results of operations, or financial condition.
+Added: For additional information regarding cybersecurity risks, see "Risk Factors" in Item 1A of this Annual Report on Form 10-K.
+Added: System Resilience, Availability, and Recovery
+Added: Interface maintains business continuity and disaster recovery plans designed to support the availability and resilience of its information systems and operations in the event of a cybersecurity incident or other disruptive event.
+Added: The disaster recovery plans are reviewed and tested annually, and we take steps to incorporate lessons learned from testing activities and industry events into our resilience planning.
+Added: Ongoing Monitoring and Continuous Improvement
+Added: Our cybersecurity program includes ongoing monitoring and evaluation activities designed to support the effectiveness of our controls and processes.
+Added: These activities include security monitoring, vulnerability assessments, and penetration testing conducted internally and by engaged third-party cybersecurity consultants and assessors.
+Added: Interface also engages external specialists, as needed, to assist with incident response, forensic investigations, and independent assessments of our cybersecurity program.
+Added: Interface also provides annual and monthly security awareness training to digitally enabled employees designed to promote responsible use of information systems and to reduce the risk of cybersecurity incidents.
+Added: Management uses the results of these activities to inform enhancements to the Company's cybersecurity program and to address emerging risks.
+Added: Governance and Oversight
+Added: The Board of Directors has delegated oversight of Interface's cybersecurity risk management to the Audit Committee of the Board of Directors.
+Added: The Audit Committee is comprised of board members with diverse experience and expertise to effectively oversee risk, although none of them are cybersecurity experts.
+Added: The Audit Committee receives quarterly updates from management regarding cybersecurity risks, threat environment developments, and the Company's cybersecurity posture through our enterprise risk management process.
+Added: Our Chief Information Officer reports directly to the Chief Executive Officer and is responsible for the ongoing management of our cybersecurity program, including the identification and evaluation of risks and the implementation of risk mitigation strategies to maintain a strong cybersecurity posture.
+Added: Our Chief Information Officer, in his capacity, regularly informs the Audit Committee (typically twice per year) and the full board (typically once per year) on all aspects related to cybersecurity risks, as well as any remediation efforts in response to a cybersecurity incident.
+Added: The Chief Information Officer works in coordination with leaders across information technology, legal, risk management, compliance, and operations to ensure a comprehensive approach to cybersecurity risk management.
+Added: Our Chief Information Officer has over twenty-five years of diverse experience aligning information technology strategies to business objectives at global companies.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.