3 unchanged sentences
The framework allows us to identify, assess and mitigate the risks we face, and assists us in establishing policies and safeguards to protect our systems and the information of those we serve.
−Removed: Our cybersecurity program is managed by our Chief Digital and Technology Officer and Chief Information Security Officer.
−Removed: The Audit and Finance Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the Company’s cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies.
−Removed: As part of this process, the Audit and Finance Committee receives regular updates from the Chief Digital and Technology Officer and Chief Information Security Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.
+Added: Our cybersecurity program is managed by our Chief Digital and Technology Officer and our Chief Security Officer .
+Added: The Audit and Finance Committee of the Board of Directors has oversight of our cybersecurity program and is responsible for reviewing and assessing the effectiveness of the Company’s cybersecurity and data protection policies, procedures and resource commitment, including key risk areas and mitigation strategies.
+Added: As part of this process, the Audit and Finance Committee receives regular updates from the Chief Digital and Technology Officer and the Chief Security Officer on critical issues related to our information security risks, cybersecurity strategy, supplier risk and business continuity capabilities.
+Added: The Audit and Finance Committee has also added a leading cybersecurity incident and response firm to serve as its advisor on cybersecurity matters.
The Company’s framework includes an incident management and response program that continuously monitors the Company’s information systems for vulnerabilities, threats and incidents;
1 unchanged sentence
remediates vulnerabilities;
−Removed: and communicates the details of threats and incidents to management, including the Chief Digital and Technology Officer and Chief Information Security Officer, as deemed necessary or appropriate.
−Removed: Pursuant to the Company’s incident response plan, incidents are reported to the Audit and Finance Committee, appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.
−Removed: We work to require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws.
−Removed: We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and ensure they employ appropriate and effective controls and continuity plans for their systems and operations.
+Added: and communicates the details of significant threats and incidents to management, including the Chief Digital and Technology Officer and the Chief Security Officer, as deemed necessary or appropriate.
+Added: Pursuant to the Company’s incident response plan, incidents are reported to the Audit and Finance Committee and appropriate government agencies and other authorities, as deemed necessary or appropriate, considering the actual or potential impact, significance and scope.
+Added: We require our third-party partners and contractors to handle data in accordance with our data privacy and information security requirements and applicable laws.
+Added: We regularly engage with our suppliers, partners, contractors, service providers and internal development teams to identify and remediate vulnerabilities in a timely manner and monitor system upgrades to mitigate future risk, and evaluate whether they employ appropriate and effective controls and continuity plans for their systems and operations.
To ensure that our program is designed and operating effectively, our infrastructure and information systems are audited periodically by internal and external auditors.
5 unchanged sentences
These assessments complement our other assessment work by evaluating our cybersecurity program as a whole.
−Removed: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Chief Information Security Officer.
+Added: We complete an enterprise information risk assessment as part of our overall enterprise information security risk management assessment, which is overseen by our Chief Security Officer.
This risk assessment is a review of internal and external threats that evaluates changes to the information risk landscape to inform the investments and program enhancements to be made in the future to rapidly respond and recover from potential attacks, including rebuild and recovery protocols for key systems.
−Removed: We evaluate our enterprise information security risk to ensure we address any unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company’s overall enterprise risk management program.
−Removed: We believe our Chief Digital and Technology Officer and Chief Information Security Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program.
+Added: We evaluate our enterprise information security risk to address unexpected or unforeseen changes in the risk environment or our systems and the resulting impacts are communicated to the Company’s overall enterprise risk management program.
+Added: We believe our Chief Digital and Technology Officer and our Chief Security Officer have the appropriate knowledge and expertise to effectively manage our cybersecurity program.
The Chief Digital and Technology Officer has experience leading enterprise digital transformation efforts for a large multinational corporation and held several leadership and growth positions at a global technology consulting and services firm before joining UnitedHealth Group.
−Removed: Our Chief Information Security Officer has experience leading a global digital portfolio for a large multinational corporation and held key leadership roles for a large technology and software company, including overseeing information security, before joining UnitedHealth Group.
+Added: Our Chief Security Officer has more than 30 years of experience as a security professional in both the private and public sectors, including in law enforcement.
+Added: Prior to joining UnitedHealth Group, he served in security leadership roles at several large multinational corporations and has additionally served on cybersecurity advisory boards for some of the largest corporations in the country.
As of December 31, 2024, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future.
For further information about the cybersecurity risks we face, and potential impacts, see Part I, Item 1A, “Risk Factors.”
−Removed: On February 22, 2024, we disclosed the occurrence of a cybersecurity incident.
−Removed: We continue to investigate the extent of the incident, which we believe was committed by cybercrime threat actors.
−Removed: As of the date of this report, we have not determined the incident is reasonably likely to materially impact our financial condition or results of operations.
We own and lease real properties to support our business operations in the United States and other countries.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.