−Removed: STAFF COMMENTS
+Added: UNRESOLVED STAFF COMMENTS
CYBERSECURITY
6 unchanged sentences
United recognizes the critical importance of cybersecurity in our business operations.
−Removed: Our cybersecurity processes are fully integrated into our overall risk management system and processes.
+Added: Our cybersecurity processes are fully integrated into our overall risk management system.
We believe that effective management of cybersecurity risks is integral to the protection of our assets, reputation, and the trust of our stakeholders.
−Removed: Our proactive approach to cybersecurity involves numerous processes including, regular risk assessments, employee training, incident response planning and testing, and continuous improvement in our cybersecurity practices.
−Removed: To ensure the robustness of our cybersecurity processes, we engage qualified assessors, consultants, and auditors on a periodic
+Added: Our proactive approach to cybersecurity involves numerous processes including, regular risk assessments, employee training and continuing education, incident response planning and testing, and continuous improvement in our cybersecurity practices.
+Added: To ensure the robustness of our cybersecurity processes, we engage qualified assessors, consultants, and auditors on a periodic basis.
These experts evaluate the effectiveness of our cybersecurity controls, identify vulnerabilities, and recommend improvements.
−Removed: We maintain ongoing relationships with reputable third-party firms specializing in cybersecurity to assess our systems, conduct penetration testing, and audit our processes for compliance with industry standards and regulations.
+Added: We maintain ongoing relationships with reputable
+Added: third-party firms specializing in cybersecurity to assess our systems, conduct penetration testing, and audit our processes for compliance with industry standards and regulations.
United recognizes the inherent cybersecurity risks associated with third-party service providers.
5 unchanged sentences
Risk Factors for a further discussion of risk related to cybersecurity.
−Removed: The Board of Directors’ risk management oversight is provided primarily by the Board Risk Committee.
+Added: The Board of Directors’ risk management oversight
+Added: primarily by the Board Risk Committee .
The Risk Committee oversees the Company’s Enterprise Risk Management Program and the processes established identify, measure, manage and monitor United’s significant financial and other risk exposures.
4 unchanged sentences
The CIRO provides regular risk management reports to the Risk Committee and the full Board of Directors, as well as at meetings of the independent directors.
−Removed: The management of the Company’s cybersecurity team has over a 100 years of industry experience combined, holds numerous certifications, and is regularly trained through continuing professional education.
+Added: The management of the Company’s cybersecurity team has over 100 years of industry experience combined, holds numerous certifications, and is regularly trained through continuing professional education.
Information security, and specifically cyber security, is formally discussed quarterly at the Governance Steering Committee (“GSC”).
1 unchanged sentence
The activities of the GSC are reported quarterly to the Board Risk Committee .
−Removed: The CISO is responsible for leading and c oordinatin
−Removed: g our daily cybersecurity efforts, including leading a team of qualified individuals with significant relevant experience and certifications.
+Added: The CISO is responsible for leading and coordinating our daily cybersecurity efforts, including leading our Information Security department which consists of a team of qualified individuals with significant relevant experience and certifications.
In addition, United’s CISO has served in various roles in Operations, Physical Security, Fraud Investigations, and Information Security for over 24 years with United.
5 unchanged sentences
All employees have a responsibility to report suspected or verified incidents to the Information Security department and/or the CISO, and all employees are trained annually regarding the identification and reporting of incidents.
−Removed: The CISO maintains a centralized record all incidents and reports on these quarterly to the GSC and the Board Risk Committee.
+Added: The CISO maintains a centralized record of all incidents and reports on these quarterly to the GSC and the Board Risk Committee.
The CIRO is also immediately notified of any incident that exceeds pre-defined thresholds.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.