8 unchanged sentences
Action plans may be developed for identified control issues and management is responsible for addressing these issues .
−Removed: Although management is responsible for the firm’s day to day cybersecurity operations, the Board of Directors oversees the firm’s cybersecurity program.
+Added: Although management is responsible for the firm’s day to day cybersecurity operations, the Board of Directors ("the Board") oversees the firm’s cybersecurity program.
The Board does not delegate this responsibility to a committee, nor does the Board identify a cybersecurity expert to consider the firm’s activities and make recommendations or provide advice to the Board.
Instead, many of our directors have significant technology experience gained through their prior work experience and through their positions on other boards of directors, all of which provides the Board with insight and practical guidance in overseeing the firm’s technology and operations as well as our continuing investment in and development of our cybersecurity program.
−Removed: Our Chief Executive Officer and President (CEO) has ultimate responsibility for developing strategy and overseeing execution to meet the firm’s objectives.
+Added: Our CEO has ultimate responsibility for developing strategy and overseeing execution to meet the firm’s objectives.
The CEO has delegated to our Chief Operating Officer (COO) oversight of this operational execution.
3 unchanged sentences
The Enterprise Risk team provides guidance and support in identifying, assessing, and monitoring all aspects of risks from cybersecurity threats.
−Removed: The Enterprise Risk function conducts risk assessments for technology and cybersecurity, and coordinates with Internal Audit and Firm-wide Compliance to provide risk assurance activities.
+Added: The Enterprise Risk function conducts risk assessments for technology and cybersecurity, and coordinates with Internal Audit and Global Compliance to provide risk assurance activities.
Enterprise Risk is primarily responsible for reporting risks from cybersecurity threats to executive leadership and our Enterprise Risk Management Committee (ERMC).
1 unchanged sentence
This committee monitors risk management activities, including cybersecurity matters, and reports periodically and more frequently, as necessary, to our Board of Directors and Audit Committee.
+Added: For example, at each quarterly meeting the Audit Committee receives an update concerning the company’s cybersecurity metrics.
+Added: In addition, at least annually the Board receives a technology and cybersecurity update led by the senior management from the company’s technology and information security teams.
Cybersecurity risk management practices operate enterprise-wide, across T.
8 unchanged sentences
Within Global Technology, Enterprise Security is responsible for maintaining security policies, standards, and guidelines and routinely works with our Enterprise Risk, Compliance, Internal Audit, and other key technology and corporate stakeholders to establish security controls, enforce them, and monitor their adherence on an ongoing basis.
−Removed: Enterprise Security also conducts regular phishing tests and manages annual employee training focused on raising awareness, highlighting the important role our employees play in protecting the firm from cybersecurity threats.
+Added: Enterprise Security also conducts regular phishing tests and manages annual employee training
+Added: focused on raising awareness, highlighting the important role our employees play in protecting the firm from cybersecurity threats.
Business Continuity and Disaster Recovery programs execute regular testing across business and technology teams to demonstrate resilience.
3 unchanged sentences
Assessments include third-party validation to help ensure our internal controls and safeguards adhere to security and compliance standards.
−Removed: We annually undergo external examinations, such as Sarbanes-Oxley relating to financial reporting and SOC 1 and/or SOC 2 for key operational Business Units.
+Added: We annually undergo external examinations, such as Sarbanes-Oxley relating to financial reporting, System and Organization Controls (SOC) 1, and SOC 2 for key operational Business Units.
In addition, we periodically engage with third-party partners to perform an independent evaluation of our cybersecurity program as well as external network penetration testing.
2 unchanged sentences
The results of these assessments are discussed with and reviewed by the Audit Committee, and shared with the Board, annually.
−Removed: Within the firm's global Procurement department, governance processes are established, including a formal Supplier Risk Management program overseeing third-party relationships based on documented risk thresholds.
+Added: Within the firm's global risk department, governance processes are established, including a formal Supplier Risk Management program overseeing third-party relationships based on documented risk thresholds.
The Supplier Risk Management program performs regular assessments, including information security reviews.
2 unchanged sentences
We have previously been the target of cybersecurity attacks and expect such attempts to continue, potentially with more frequency or sophistication.
−Removed: Although no cybersecurity incident during the year ended December 31, 2023 resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on the firm’s strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted.
+Added: Although no cybersecurity incident during the year ended December 31, 2024, resulted in an interruption of our operations, known losses of critical data, nor a material impact on the firm’s strategy, financial condition or results of operations.
+Added: The scope and impact of any future incident cannot be predicted.
See “Item 1A.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.