7 unchanged sentences
This program includes governance structure, risk identification, risk analysis, risk management, and risk communication and reporting.
−Removed: On a periodic basis, the Company engages independent third-party subject matter experts to conduct a cybersecurity maturity assessment based on the National Institute of Standards Technology framework, focused on risk assessment, global payment card industry audits, and compliance audits to help identify gaps and improve existing processes.
−Removed: In addition, the Company has a cybersecurity risk program that includes policies and procedures around onboarding of third-parties, contractual agreement review, risk assessment and on-going monitoring of high-risk vendors.
+Added: On a periodic basis, the Company engages independent third-party subject matter experts to conduct a cybersecurity maturity assessment based on the National Institute of Standards and Technology framework, focused on risk assessment, global payment card industry audits, and compliance audits to help identify gaps and improve existing processes.
+Added: In addition, the Company has a cybersecurity risk program that includes policies and procedures around onboarding of third parties, contractual agreement review, risk assessment and ongoing monitoring of high-risk vendors.
The Company also has several tools and processes in place to actively prevent, detect and manage cybersecurity incidents.
6 unchanged sentences
• Disaster Recovery and Business Continuity Plans – covering both technology and business areas globally with annual exercises to validate processes.
−Removed: • Cybersecurity Awareness – educating employees and third-party service providers on best practices for protecting the Company from cyber threats, which includes providing annual security and privacy industry-specific training to employees as well as conducting period phishing simulations to test their awareness.
+Added: • Cybersecurity Awareness – educating employees and third-party service providers on best practices for protecting the Company from cyber threats, which includes providing annual security and privacy industry-specific training to employees as well as conducting periodic phishing simulations to test their awareness.
We are continuously enhancing our cybersecurity framework in response to the ongoing incidents and threats that we face.
10 unchanged sentences
The Company has an Information Governance, Privacy & Security Committee responsible for management oversight of cybersecurity risk, which includes the CISO and key members of management and meets quarterly.
−Removed: As part of our cyber incident response plan, our CISO is responsible escalating certain cybersecurity incidents to relevant senior management, along with several stakeholders, who then convene to evaluate the materiality of such incident using a list of quantitative and qualitative guidelines.
+Added: As part of our cyber incident response plan, our CISO is responsible for escalating certain cybersecurity incidents to relevant senior management, along with several stakeholders, who then convene to evaluate the materiality of such incident using a list of quantitative and qualitative guidelines.
In addition, outside advisors would be engaged as deemed necessary.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.