6 unchanged sentences
Management is responsible for the Company’s day-to-day risk management activities and processes, and our Board’s role is to engage in informed oversight of, and provide guidance with respect to, such risk management activities and processes.
−Removed: The Company’s cybersecurity policies, standards, and practices are fully integrated into the Company’s ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the
−Removed: International Organization for Standardization and other applicable industry standards.
+Added: The Company’s cybersecurity policies, standards, and practices are fully integrated into the Company’s ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.
In general, the Company seeks to address cybersecurity risks through a comprehensive, proactive cross-functional approach that is focused on preserving the confidentiality, security, and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents if they occur.
17 unchanged sentences
We assess ourselves against the National Institute of Standards and Technology Cybersecurity Framework, Payment Card Industry Data Security Standard and management’s defined technology controls to support internal controls over financial reporting.
−Removed: These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.
+Added: These efforts include a
+Added: wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.
The Company regularly engages third parties to perform assessments on our cybersecurity measures , including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness, including network penetration assessments.
5 unchanged sentences
The Company’s Board of Directors is actively engaged in oversight of cybersecurity, and it is part of the responsibilities of our Audit Committee .
−Removed: The Company’s Chief Technology and Information Officer (CTIO) and Chief Executive Officer keep the Board informed on cybersecurity and privacy matters throughout the year, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company’s peers and third parties.
+Added: The Company’s Chief Technology and Transformation Officer (CTTO) and President and Chief Executive Officer keep the Board informed on cybersecurity and privacy matters throughout the year , which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to the Company’s peers and third parties.
The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.
−Removed: The Company’s cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CTIO and our Vice President IT Risk Management.
−Removed: The Company’s CTIO works collaboratively across the Company to implement a program designed to protect the Company’s information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company’s incident response plans.
+Added: The Company’s cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our CTTO and our Vice President IT Risk Management .
+Added: The Company’s CTTO works collaboratively across the Company to implement a program designed to protect the Company’s information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company’s incident response plans.
To facilitate the success of the Company’s cybersecurity risk management program, we have a unified and centrally coordinated team, led by our Vice President IT Risk Management, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices in close coordination with senior leadership and other teams across Ulta Beauty.
1 unchanged sentence
In addition to our extensive in-house cybersecurity capabilities, at times we also engage consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.
−Removed: The Company’s CTIO leads the core elements of Ulta Beauty’s IT and Digital functions, including IT infrastructure, systems and security, digital experience and operations, and consumer technology.
+Added: The Company’s CTTO leads the core elements of Ulta Beauty’s IT and Digital functions, including IT infrastructure, systems and security, digital experience and operations, and consumer technology.
He has served in various roles in information technology and information security for over 30 years, including serving as the Global Chief Technology Officer of a large public company prior to joining the Company.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.