7 unchanged sentences
Our ERM program is designed to identify the top risks applicable to us and document risk mitigation plans and initiatives by management.
−Removed: We have identified, and we expect to continue to identify, cybersecurity threats as among the top risks that we
+Added: We have identified, and we expect to continue to identify, cybersecurity threats as among the top risks that we face.
As one of the critical elements of our overall ERM approach, our information security program is focused on the following key areas:
10 unchanged sentences
• Third-Party Risk Management:
−Removed: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
+Added: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the
+Added: systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
• Education and Awareness:
−Removed: We provide training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, processes and practices.
+Added: We provide training for employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, processes and practices.
• Incident Response and Recovery Planning:
We have established and maintain incident response and recovery plans for critical systems, applications and business functions that address our response to a cybersecurity incident, and such plans are tested and evaluated on a periodic basis.
−Removed: We describe whether and how risks from identified cybersecurity threats, including as a result of previous incidents, may materially affect, or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “ Failure to maintain the integrity of internal or customer data or to protect our systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to significant costs, fines or lawsuits ” included as part of our risk factor disclosures included in Part I, Item 1A of this Annual Report filed on Form 10-K.
+Added: We describe whether and how risks from identified cybersecurity threats, including as a result of previous incidents, may materially affect, or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, under the heading “ Failure to maintain the integrity of internal or customer data or to protect our systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to significant costs, fines or lawsuits ” included as part of our risk factor disclosures included in Part I, Item 1A of this Annual Report filed on Form 10-K.
Cybersecurity Governance
2 unchanged sentences
In addition, the CTO and CISO provide the Audit Committee with timely information regarding significant cybersecurity incidents, as applicable.
−Removed: During 2023, the Audit Committee also held an informational meeting with an external advisor regarding the cybersecurity landscape.
The IPRC is the management-level governance body that oversees our management of cybersecurity threats and data privacy risks and supports the strategic goals of our information security programs.
The IPRC also oversees the appropriate remediation and response to cybersecurity incidents in accordance with applicable legal and regulatory requirements as well as our Information Security Incident Response Plan.
−Removed: The executive sponsors of the IPRC are our Chief Financial Officer, Chief Operations Officer, Wyndham Destinations, the CTO, and General Counsel and Corporate Secretary.
−Removed: The IPRC members include our CISO, the senior legal officer in the privacy function, the business segments general counsel, the Chief Accounting Officer, and the Managing Director RCI North America & Global Marketing and Operations.
−Removed: The CISO leads a team of
−Removed: information security professionals in the day-to-day execution of our information security program, which is discussed in more detail above under the heading “ Cybersecurity Risk Management and Strategy.
+Added: The executive sponsors of the IPRC are our Chief Financial Officer, Chief Operations Officer, CTO, and General Counsel and Corporate Secretary.
+Added: The IPRC members include our CISO, the senior attorney in the privacy function, the senior attorney in the corporate and securities function, the Chief Accounting Officer, and the Managing Director, Travel and Membership.
+Added: The CISO leads a team of information security professionals in the day-to-day execution of our information security program, which is discussed in more detail above under the heading “ Cybersecurity Risk Management and Strategy.
The CISO has served in various roles in information security and information technology for over 20 years for global travel, hospitality, casino, and energy companies along with consulting for both the U.S.
1 unchanged sentence
He holds an undergraduate degree in computer information systems, a master’s degree in business administration, and has attained the Certified Information Systems Security Professional certification.
−Removed: The CTO holds an undergraduate degree in computer science and a master’s degree in business administration, and has served in various roles in information technology for over 30 years for global travel, hospitality, and finance companies, including serving as either the Chief Technology Officer or Chief Information Officer of Qatar Airways Group and MGM Resorts International.
+Added: The CTO holds an undergraduate degree in computer science and a master’s degree in business administration and has served in various roles in information technology for over 30 years for global travel, hospitality, and finance companies, including serving as the Chief Technology Officer for Qatar Airways Group and Chief Information Officer for MGM Resorts International.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.