3 unchanged sentences
We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats.
−Removed: Those processes include responses to and assessments of internal and external threats to the security, confidentiality, integrity and availability of the Company’s data and systems along with other material risks to firm operations, at least annually or whenever there are material changes to our systems or operations.
−Removed: As part of our risk management process, we engage outside providers to conduct periodic internal and external penetration testing.
−Removed: We use NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity relevant to our business.
−Removed: This does not imply that we meet any particular technical standards, specifications, or requirements.
−Removed: We store firm data in cloud environments with security appropriate to the data involved and have adopted controls around, among other things, vendor risk assessment, access and acceptable use and backup and recovery.
−Removed: We have processes to oversee and identify material risks associated with the use of third-party service providers, taking into account the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider.
+Added: Those processes include risk assessments of internal and external threats to confidentiality, integrity and availability of the Company’s data and systems along with other material risks to firm operations.
+Added: These risk assessments inform our cybersecurity program and the continued development of a layered set of controls aimed at preventing, detecting and responding to threats.
+Added: Our administrative, organizational, technical and physical security controls include, but are not limited to, policies and procedures, system hardening vulnerability scanning and patching, employee training and awareness, third-party risk management processes, backup and recovery processes, access controls, data encryption in transit and at rest, network perimeter controls and identity verification.
+Added: We also have policies and controls in place designed to detect and respond to cybersecurity events, including an incident response plan, an incident response team with dedicated roles and responsibilities for assessing and responding to a cybersecurity event, system logging and ongoing monitoring, and periodic training exercises simulating cybersecurity events that are designed to raise awareness and test our team’s response readiness capabilities.
+Added: The nature, scope and effectiveness of these controls are regularly reviewed through a series of internal and external processes.
+Added: The Cybersecurity team performs both automated monitoring on a continuous basis and manual reviews of key controls.
+Added: We also conduct annual assessments of our cybersecurity program using industry standard cybersecurity frameworks, such as the NIST Cybersecurity Framework, as benchmarks to perform our evaluation.
+Added: This does not imply that we fully meet any particular industry standards, specifications or requirements.
+Added: In addition, independent reviews of our cybersecurity control effectiveness are conducted by TPG’s Internal Audit team on a periodic basis.
+Added: We also engage external providers to conduct periodic external assessments, including penetration testing.
We have established an Enterprise Risk Committee (“ERC”) to manage overall risk across the Company including cybersecurity risks identified by the Cybersecurity team;
−Removed: the ERC includes representatives from relevant functions and is led by our Chief Executive Officer (“CEO”).
+Added: the ERC includes representatives from relevant functions and is led by our CEO.
We have also established an Operational Risk Committee (“ORC”) which is responsible for applying the policy decisions of the ERC.
−Removed: Operational responsibility for ensuring the adequacy and effectiveness of our risk management, control and governance processes is assigned to our Chief Information Security
−Removed: Officer, who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and, in coordination with the Chief Information Officer and Head of Operations, reports to the ERC at least annually.
−Removed: The Chief Information Security Officer leads the Company’s cybersecurity team, which includes individuals dedicated to incident detection and response.
−Removed: This team is responsible for identifying threats that can impact the Company and designing controls to mitigate vulnerabilities before they are exploited and to detect and neutralize any threats that do materialize.
−Removed: The Chief Information Security Officer and Chief Information Officer each have more than 20 years of experience in their fields.
−Removed: The Chief Information Security Officer and senior members of the cybersecurity team hold industry standard certifications.
−Removed: Our Audit Committee is briefed on cybersecurity risks at least once each year and as needed in connection with any potentially material cybersecurity incidents.
−Removed: The Chief Information Security Officer reports at least annually, to our Audit Committee and such report may address overall assessment of the Company’s compliance with this and other cybersecurity policies, including topics such as risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.
+Added: Operational responsibility for ensuring the adequacy and effectiveness of our risk management, control and governance processes is assigned to our Chief Information Security Officer (“CISO”), who periodically reports, among other things, potentially material cybersecurity incidents to the ORC and reports to the ERC at least annually.
+Added: The Cybersecurity team also regularly coordinates with other key stakeholders within the Firm, including Compliance, Human Resources, Internal Audit and Legal.
+Added: The Chief Information Security Officer leads the Company’s Cybersecurity team, which is responsible for implementing, maintaining and enforcing our cybersecurity program.
+Added: Our CISO previously held various leadership roles within the Technology Risk department of one of the world’s largest banking institutions over a 17-year period.
+Added: He holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington and is a Certified Information Systems Security Professional (CISSP).
+Added: Our Cybersecurity team possesses a variety of cybersecurity skill sets and extensive expertise obtained through decades of experience, numerous industry certifications, and advanced degrees.
+Added: The Cybersecurity team continues to take steps to maintain up-to-date knowledge of evolving cybersecurity threats and countermeasures.
+Added: The Audit Committee of our Board of Directors has primary oversight over the Cybersecurity program.
+Added: The Chief Information Security Officer reports at least annually to the Audit Committee and such report may address overall assessment of the Company’s compliance with our cybersecurity policies, including risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses, and recommendations for changes and updates to policies and procedures.
As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.
+Added: Cyber criminals do, however, target TPG and our employees and vendors.
+Added: Ongoing or future attacks such as these could have impacts on TPG’s operations.
+Added: For additional information on these ongoing risks please refer to “Part 1.
+Added: Risk Factors — Failure to maintain the security of our information and technology networks or data security breaches could harm our reputation and have a material adverse effect on our results of operations, financial condition, and cash flow”.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.