3 unchanged sentences
The cybersecurity risk management processes described below are integrated into the Company’s overall risk management system.
−Removed: Each Trimble sector has identified a dedicated expert to assess vulnerabilities, calculate risks and determine where risk mitigation efforts are needed.
+Added: Each Trimble business has identified a dedicated expert to assess vulnerabilities, calculate risks, and determine where risk mitigation efforts are needed.
These experts work with the Company’s Chief Information Security Officer (“CISO”) and alongside product engineering personnel, to review technical risk data that comes from our central risk tracking system, prioritize risk mitigation activities, and manage other risk management processes.
We employ a variety of security protections in our digital systems, including access controls and logging, denial of service protection, and automated intrusion-prevention tools.
−Removed: We have an information security training program, including an annual program of general security awareness for all employees and developer training throughout the year.
+Added: We have a cybersecurity awareness program which covers topics such as phishing, social networking safety, password security, and mobile device usage.
+Added: We have an information security training program, including an annual program of general
+Added: security awareness for all employees and developer training throughout the year.
+Added: We also conduct regular phishing simulations, with follow-up training as needed, for employees and contractors.
We maintain an information security risk insurance policy.
4 unchanged sentences
Our cloud-based systems, including products we sell, utilize configurations for backup designed to prevent data from being destroyed as a result of a cyber event.
+Added: We implement controls and procedures designed to measure and mitigate risk with third-party vendors and business partners who have access to sensitive information, including conducting a security risk assessment.
+Added: Identified security risks are remediated or documented, and in some cases, the business relationship may be ended or not pursued.
+Added: We also perform a vendor security assessment process for purchases over a certain minimum threshold.
Trimble’s incident response process is based on widely accepted industry frameworks, such as the cybersecurity framework set forth by the National Institute of Standards and Technology (“NIST”).
−Removed: Our framework includes steps to:
−Removed: identify threat actors, contain the affected infrastructure, eradicate threat actor access, recover affected data or systems, and study lessons learned to help ensure any root causes are mitigated outside of the affected area.
+Added: Our framework includes steps to identify threat actors, contain the affected infrastructure, eradicate threat actor access, recover affected data or systems, and study lessons learned to help ensure any root causes are mitigated outside of the affected area.
Each year, our team of cybersecurity specialists builds a strategic vision of shared outcomes, which provides the basis for how cybersecurity risks are factored into the Company’s risk management initiatives.
2 unchanged sentences
We also perform an annual external “red team” assessment that provides an attack simulation for our security operations team to identify and triage.
−Removed: We perform a vendor security assessment process for purchases over a certain minimum threshold.
To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected, and the Company is not aware of a basis to believe that such risks are reasonably likely to materially affect, the Company, including its business strategy, results of operations, or financial condition.
4 unchanged sentences
The CISO presents quarterly or as needed at the Audit Committee meetings on the Company’s cybersecurity risk management activities.
−Removed: We have a dedicated team that is led by the CISO, who has a technical degree in computer science from an accredited public university and has over 20 years of information technology and cybersecurity experience in multiple industries, including financial services and defense.
+Added: We have a dedicated team that is led by the CISO, who has a technical degree in computer science from an accredited public university and extensive experience in information technology and cybersecurity across multiple industries, including financial services and defense.
The team comprises security engineers, detection specialists, and business cybersecurity experts.
−Removed: When the team identifies credible risks, we invoke our incident response process to track and manage the details,
−Removed: quickly manage exposures, assess potential customer impact, and facilitate consistent reporting to our CEO and to our Audit Committee.
+Added: When the team identifies credible risks, we invoke our incident response process to track and manage the details, quickly manage exposures, assess potential customer impact, and facilitate consistent reporting to our CEO and to our Audit Committee .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.