8 unchanged sentences
At least twice each year, the Audit Committee receives reports and presentations from members of our team responsible for overseeing our cybersecurity risk management, including our Senior Vice President, Global Information Security (“SVP-GIS”) and our Executive Vice President and Chief Information Officer (“EVP-CIO”) , and periodically receives reports and presentations from third parties.
−Removed: These reports may address a wide range of topics, including recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties.
−Removed: The Audit Committee reports to the Board on data protection and cybersecurity matters.
+Added: These reports may address a wide range of topics, including recent developments, evolving standards, third-party and independent reviews, the threat environment, technological trends and cybersecurity considerations arising with respect to our peers and third parties.
+Added: The Audit Committee reports to the Board on cybersecurity matters.
We also have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Audit Committee in a timely manner.
1 unchanged sentence
At the management level, our SVP-GIS is responsible for the assessment and management of risks from cybersecurity threats.
−Removed: Our SVP-GIS has extensive cybersecurity knowledge and skills gained from over 20 years of work experience at the Company and elsewhere and maintains several certifications, including Certified Information Systems Security Professional (“CISSP”) from ISC Squared and Certified Information Security Manager (“CISM”) from the Informations Systems Audit and Control Association (“ISACA”).
−Removed: Our SVP-GIS leads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection policies and practices across our business and reports directly to our EVP-CIO.
−Removed: Our SVP-GIS’s direct reports include a number of experienced information security leaders responsible for various aspects of our security program, each of whom is supported by a team of experienced cybersecurity professionals.
+Added: Our SVP-GIS has extensive cybersecurity knowledge and skills gained from over 25 years of experience in government and industries including retail and manufacturing, and industry certifications including Certified Information Systems Security Professional (“CISSP”) from ISC Squared and Global Information Assurance Certification (“GIAC”) from SANS Institute.
+Added: Our SVP-GIS also has experience in forensic investigations, strategic cyber risk management, and cybersecurity program development.
+Added: Our SVP-GIS leads the team responsible for implementing, monitoring and maintaining cybersecurity policies and practices across our business and reports directly to our EVP-CIO.
+Added: Our SVP-GIS’s direct reports include a number of experienced cybersecurity leaders responsible for various aspects of our cybersecurity program, each of whom is supported by a team of experienced cybersecurity professionals.
The functions that report to our SVP-GIS include:
−Removed: cybersecurity risk management, Payment Card Industry compliance, and security testing;
−Removed: operation of protective security tools and systems;
−Removed: security monitoring, incident response, and digital forensics;
−Removed: security research and development and support for information technology and security functions.
−Removed: Our SVP-GIS works closely with our Law Department and regularly engages expert consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks and to oversee compliance with legal, regulatory and contractual security requirements.
+Added: cybersecurity risk management, Payment Card Industry compliance, and cybersecurity testing;
+Added: operation of protective cybersecurity tools and systems;
+Added: cybersecurity monitoring, incident response, and digital forensics;
+Added: cybersecurity research and development and support for information technology and cybersecurity functions.
+Added: Our SVP-GIS works closely with our Law Department and regularly engages expert consultants and other third parties to assist with assessing, identifying, and managing cybersecurity risks and to oversee compliance with legal, regulatory and contractual cybersecurity requirements.
The EVP-CIO and SVP-GIS also periodically attend Audit Committee meetings to report on any material developments.
Risk Management and Strategy
−Removed: We employ systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.
+Added: We employ systems and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems we use.
Our processes and systems include automated tools and technical safeguards managed and monitored by our cybersecurity team.
We currently carry cybersecurity insurance, however, we cannot assure you that we will be able to maintain such policies in the future or that they will be sufficient to cover all potential cybersecurity events or losses we incur in connection with such events.
−Removed: We require our associates to receive annual training on our information security policies.
+Added: We require our associates to receive annual training on our cybersecurity policies and practices.
This may include, but is not limited to, training regarding information classification and handling, data privacy, physical security, phishing, malware and ransomware, social engineering, identifying and reporting information security incidents, and secure credit card handling, as well as additional topics based on job roles and responsibilities.
−Removed: We also maintain written information security policies and procedures that apply to the entire Company and third parties who handle our data or have access to our information technology systems.
−Removed: These policies and procedures establish the framework for our information security program and cover topics such as acceptable use of information systems, security risk management, access management, audit and logging, patching, and security requirements for numerous technologies.
−Removed: These policies and procedures are reviewed at least annually, updated as necessary and integrated into employee training programs and our contracting process.
−Removed: We are also subject to the Payment Card Industry Data Security Standard and we perform an annual self-assessment according to the requirements set forth by the Payment Card Industry Security Standards Council.
+Added: We also maintain written cybersecurity policies and procedures that apply to the entire Company and third parties who handle our data or have access to our information technology systems.
+Added: These policies and procedures establish the framework for our cybersecurity program and cover topics such as acceptable use of information systems, cybersecurity risk management, access management, audit and logging, patching, and cybersecurity requirements for numerous technologies.
+Added: These policies and procedures are reviewed at least annually, updated as necessary, and integrated into employee training programs and our technology procurement process.
+Added: We are also subject to the Payment Card Industry Data Security Standard and perform an annual self-assessment according to the requirements set forth by the Payment Card Industry Security Standards Council.
Incident Response
2 unchanged sentences
The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.
−Removed: The IRP is practiced through walkthroughs and tabletop exercises on at least an annual basis.
The SVP-GIS is responsible for maintaining our IRP.
−Removed: Potentially significant threats are escalated to an interdisciplinary data breach response team (the “DBRT”), which is led our EVP-CIO and co-chaired by the SVP-GIS, our head of data privacy and a representative from our Law Department.
−Removed: The DBRT is responsible for oversight and handling of significant security threats, incidents, and issues that involve data loss or operational impact to our business through a documented process.
−Removed: Potentially material cyber events are escalated by our EVP-CIO to executive management and reviewed with members of the Company’s Disclosure Committee.
+Added: Potentially significant threats are escalated to an interdisciplinary data breach response team (the “DBRT”), which is led by our EVP-CIO and co-chaired by the SVP-GIS, our head of data privacy, and a representative from our Law Department.
+Added: The DBRT is responsible for oversight and handling of significant cybersecurity threats, incidents, and issues through a documented process.
+Added: Potentially material cybersecurity incidents are escalated by our EVP-CIO to executive management and reviewed with members of the Company’s Disclosure Committee.
Material Cybersecurity Risk, Threats & Incidents
Routinely, we partner with and use third-party service providers and products that host, manage, or control sensitive data.
−Removed: We and the companies we work with have experienced cybersecurity threats to our data and systems, including ransomware and other forms of malware and computer virus attacks, unauthorized access, systems failures and temporary disruptions.
+Added: We and the companies we work with have experienced cybersecurity incidents involving our data and systems, including ransomware and other forms of malware and computer virus attacks, unauthorized access, systems failures and temporary disruptions.
For example, in June 2018, we identified forged and fraudulently induced electronic payment disbursements we made to third parties in an aggregate amount of $10 million resulting from unauthorized third-party access to our email system.
−Removed: Risks from cybersecurity threats, including as a result of such previous incident, have not materially affected us, including our business strategy, results of operations or financial condition for the periods covered by this Annual Report, and we do not believe that such risks are reasonably likely to have such an effect over the long term.
+Added: Risks from cybersecurity incidents, including as a result of the June 2018 incident, have not materially affected us, including our business strategy, results of operations or financial condition for the periods covered by this Annual Report, and we do not believe that such risks are reasonably likely to have such an effect over the long term.
Additional information on cybersecurity risks we face can be found in Part I, Item 1A “Risk Factors” of this Annual Report under the heading “Failure to maintain the integrity of internal or customer data or to protect our information systems from cyber-attacks could disrupt our business, damage our reputation, and subject us to costs, fines or lawsuits,” which should be read in conjunction with the foregoing information.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.