2 unchanged sentences
Risk Management and Strategy
−Removed: We invest in a comprehensive cybersecurity program that applies a recognized framework, utilizes industry standard tools, relies on expert partners, connects associates across the organization and leverages communication to protect our systems and our data.
+Added: Our internal cybersecurity organization leads a comprehensive, enterprise-wide security program built on recognized industry frameworks and a clear, proactive strategy.
+Added: We operate a risk-driven model that integrates leading security technologies, leverages both internal expertise and carefully selected external partners, and unites teams across the Company to consistently strengthen our defensive posture.
Our cybersecurity program is designed to protect the confidentiality, integrity and availability of critical assets and information, using a proactive and risk-based approach.
−Removed: We utilize the National Institute of Standards and Technology (“NIST”) Cyber Security Framework and regularly reassess our cybersecurity program.
−Removed: The NIST framework is structured around five commonly defined stages (Identify, Protect, Detect, Recover and Respond) and is a comprehensive approach to information and cybersecurity risk management.
+Added: We align our program with widely accepted industry best practices and leading security frameworks, and we regularly reassess our capabilities to ensure they adapt to evolving risks and regulatory expectations.
Our policies, including our Information Security Policy and Privacy Policy, and procedures are designed to align with industry best practices and comply with regulatory requirements.
−Removed: We align our payment processing policies and procedures with industry security standards, including the Payment Card Industry Data Security Standard.
−Removed: Throughout the year, we conduct targeted audits and assessments, using internal and external resources, of certain aspects of our information security systems.
−Removed: We have developed and implemented a comprehensive program designed to protect the confidentiality of sensitive information, ensure the integrity of critical data and automated processes, and safeguard the availability of our information technology capabilities.
+Added: We also align our payment processing policies and procedures with industry security standards, including the Payment Card Industry Data Security Standard.
+Added: Throughout the year, we conduct targeted audits and assessments, using both internal and external resources to evaluate key elements.
+Added: We have developed and implemented a comprehensive program designed to protect the confidentiality of sensitive information, preserve the integrity of critical data and automated processes, and ensure the availability of our information technology capabilities.
Moreover, we have implemented appropriate policies, processes, and technology to reduce the likelihood or impact of a breach, either at US Foods or through any third-party service provider, and have appropriate cyber insurance coverage through a standalone cyber policy.
9 unchanged sentences
Governance Framework
−Removed: Under the oversight of the Audit Committee of our Board of Directors, our cybersecurity function is managed by our Technology and Innovation team, led by our Senior Vice President, Chief Information Security Officer , Sara Schmidt, with support from the Internal Audit and Legal functions.
+Added: Under the oversight of the Audit Committee of our Board of Directors, our cybersecurity function is managed by our Digital and Technology team, led by our Senior Vice President, Chief Information Security Officer , Sara Schmidt, with support from the Internal Audit and Legal functions.
Schmidt has served in the role since 2022.
1 unchanged sentence
Schmidt served as Chief Information Security Officer for Farmers Insurance, a national insurance company, from 2019 to 2022, and various other positions from 2015 to 2019.
−Removed: Schmidt began her career as a cryptography analyst with the National Security Agency (“NSA”), learning best practices and tactics to be an effective hacker and defender.
+Added: Schmidt began her career as a cryptography analyst with the National Security Agency (“NSA”), learning best practices and tactics to prevent attacks and counter threat actors.
After eight years with the NSA, she transitioned into the private sector, joining Perrigo Company from 2011 to 2015, before joining Farmers Insurance.
18 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.