3 unchanged sentences
The Board, Audit Committee, senior management and the Enterprise Risk Management Council (a taskforce comprised of senior representatives from primary corporate functions as well as senior representatives from field operations) devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner.
−Removed: Our cybersecurity risk management program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories:
−Removed: identify, protect, detect, respond and recover.
+Added: Our cybersecurity risk management program leverages the National Institute of Standards and Technology (“NIST”) framework, which organizes cybersecurity risks into six categories:
+Added: govern, identify, protect, detect, respond and recover.
We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation.
1 unchanged sentence
In addition, we have a set of Company-wide policies and procedures concerning cybersecurity matters, which include an IT security manual as well as other policies that directly or indirectly relate to cybersecurity, such as policies related to encryption standards, antivirus protection, remote access, multifactor authentication, confidential information and the use of the internet, social media, email and wireless devices.
−Removed: These policies go through an internal review process and are approved by appropriate members of management.
+Added: In the event we identify a cybersecurity incident, we have defined procedures to respond to and remediate such incident.
+Added: These policies and procedures go through an internal review process and are approved by appropriate members of management.
The Company’s Chief Information Officer is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board.
3 unchanged sentences
We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings.
−Removed: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts.
+Added: We have continued to expand investments in IT security to mitigate cybersecurity risks, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts.
We regularly test defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing our operational policies and procedures with third-party experts.
14 unchanged sentences
To aid the Board with its cybersecurity and data privacy oversight responsibilities, the Board periodically hosts experts for presentations on these topics.
−Removed: For example, in 2022, the Board hosted an expert to discuss developments in the cybersecurity threat landscape and speakers who discussed digital, technology and innovation trends across industries.
+Added: For example, in 2024, the Board hosted an expert to discuss developments in the cybersecurity threat landscape and current cybersecurity trends across industries.
We face a number of cybersecurity risks in connection with our business.
Although such risks have not materially affected us, including our business strategy, results of operations or financial condition, to date, we have, from time to time, experienced threats to and breaches of our data and systems, including malware and computer virus attacks.
−Removed: information about the cybersecurity risks we face, see the risk factor entitled “Disruptions in our information technology systems or a compromise of security with respect to our systems could adversely affect our operating results by limiting our ability to effectively monitor and control our operations, adjust to changing market conditions, implement strategic initiatives or support our online ordering system” in Item 1A- Risk Factors.
+Added: For more information about the cybersecurity risks we face, and how, if realized, those risks are reasonably likely to materially affect us, see the risk factor entitled “Our financial performance and our reputation could be adversely affected, and we could be subject to legal liability or regulatory enforcement actions, if we are unable to protect against, or effectively respond to, cyberattacks or other cyber incidents” in Item 1A- Risk Factors.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.