7 unchanged sentences
This approach includes various assessment activities (e.g.
−Removed: threat actor emulation and penetration testing), tabletop exercises, security awareness and training activities (e.g., simulated phishing campaigns and specialized training for cybersecurity personnel), encryption of certain types of information, and certain controls governing access to TJX facilities and systems, among other threat- and risk-based safeguards.
+Added: threat actor emulation and penetration testing), tabletop exercises, security awareness and training activities (e.g.
+Added: simulated phishing campaigns and specialized training for cybersecurity personnel), encryption of certain types of information, and certain controls governing access to TJX facilities and systems, among other threat- and risk-based safeguards.
The scope and level of our risk-based initiatives in these areas varies across functions and across the business.
−Removed: We maintain an Information Management Program that is overseen by our Information Management Steering Committee (the “IMSC”), which is a cross-functional group consisting of senior leaders from areas such as IT, IT Security, Risk and Compliance, Privacy, Legal, and Audit.
+Added: We maintain an Information Management Program that is overseen by our Information Management Steering Committee (the “IMSC”), which is a cross-functional group consisting of senior leaders from areas such as IT, Cybersecurity, Risk and Compliance, Privacy, Legal, and Audit.
The IMSC is responsible for developing and updating policies to support TJX’s Information Management Program and enhance the overall privacy, information security, and records management posture of our business.
−Removed: Within our IT Security department, our Security Operations Center provides threat detection and incident response capabilities.
+Added: Within our Cybersecurity department, our Security Operations Center provides threat detection and incident response capabilities.
We also have an incident response plan which describes roles and responsibilities for internal stakeholders in responding to and escalating potential cybersecurity incidents.
11 unchanged sentences
Our CISO is informed about and monitors the prevention, detection and mitigation of cybersecurity threats through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.
−Removed: Other than the unauthorized intrusion into our network discovered late in 2006, discussed in Item 1A in this Form 10-K, we are not aware of a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition.
−Removed: Despite our continuing efforts, our cybersecurity safeguards may not prevent breaches or breakdowns of our or our third-party service providers’ IT systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors.
+Added: As discussed in Item 1A in this Form 10-K, despite our continuing efforts, our IT systems, as well as those of our suppliers, service providers and other third parties whose IT systems we utilize directly or indirectly, are targeted by attempts to access or obtain personal or other sensitive information, attempts at monetary theft and attempts to disrupt business.
+Added: These attempts continue to evolve and are becoming increasingly sophisticated (including through the use of artificial intelligence).
+Added: While some of these attempts have resulted in cybersecurity incidents, the unauthorized intrusion into our network discovered late in 2006 is the only such cybersecurity incident to date that has been material to the results of our operations.
For more information, see “Compromises of our cybersecurity, disruptions in our information technology systems, or failure to satisfy the information technology needs of our business could result in material loss or liability, materially impact our operating results or materially harm our reputation.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.