1 unchanged sentence
Cybersecurity
−Removed: We have a cybersecurity program to assess, identify, and manage risks from cybersecurity threats.
+Added: We have a cybersecurity program designed to assess, identify and manage risks from cybersecurity threats.
The Company’s cybersecurity program includes administrative, technical and physical safeguards that address our information systems, including our IT and operational technology environments.
2 unchanged sentences
Our cybersecurity strategy leverages administrative safeguards that include policies, procedures and processes to assess, identify and manage risks from cybersecurity threats.
−Removed: We have adopted a Cybersecurity Incident Response Policy (the “CIRP”), which provides a framework and guidance for investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.
−Removed: Additionally, all of the Company’s employees undertake an annual cybersecurity training program on how to identify characteristics of various cybersecurity threats, which is augmented by additional training and communications on IT and cybersecurity matters throughout the year.
−Removed: Periodically during the year, the Company’s IT department leads simulations of cybersecurity incidents with employees to test the organization’s ability to respond to a variety of cybersecurity-related scenarios.
−Removed: Our policies, procedures, and processes are aligned with our technical tools, which include continuous security monitoring and alerting, an AI-based tool to facilitate cybersecurity incident identification and remediation, and other technologies, to ensure the security of our systems and information.
+Added: We have adopted a Cybersecurity Incident Response Policy (the “CIRP”), which provides a framework and procedures for investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.
+Added: Additionally, all of the Company’s employees are required to undertake an annual cybersecurity training program on how to identify characteristics of various cybersecurity threats and ways to report such threats, which is augmented by additional training and communications on IT and cybersecurity matters throughout the year.
+Added: Periodically during the year, the Company’s IT department leads simulations of cybersecurity incidents with employees, including annual tabletop exercises for offshore employees, to test the organization’s ability to respond to a variety of cybersecurity-related scenarios.
+Added: Our policies, procedures and processes are aligned with our technical tools, which include security monitoring and alerting, cybersecurity incident identification and remediation, and other technologies to ensure the security of our systems and information.
We also have implemented certain physical safeguards, such as restricted access to areas containing critical IT and operational technology equipment, to mitigate risks to our physical environment.
1 unchanged sentence
Cybersecurity-related risks are included in our ERM risk register, which are reviewed by internal stakeholders who designate the relative level of severity of identified risks.
−Removed: The ERM risk register, which includes any identified cybersecurity-related risks, is reviewed by our Executive Management Committee and is reported quarterly to the board of directors, who then reviews the identified risks, mitigation plans and monitoring reports and provides oversight as appropriate.
+Added: The ERM risk register, which includes any identified cybersecurity-related risks, is reviewed by our Executive Management Committee and is reported quarterly to the board of directors, who then reviews the risk register, including any changes in key risks, and provides oversight as appropriate.
The Audit Committee is responsible for, and actively engaged in, the oversight of our IT and cybersecurity program, including the oversight of risks from cybersecurity threats.
−Removed: All members of the Audit Committee have prior work experience relating to cybersecurity or have obtained a certification or degree in cybersecurity.
−Removed: The Audit Committee, at least quarterly, receives reports from the Company’s Senior Director – Information Technology (“SDIT”) on, among other things, the Company’s cybersecurity incidents, risks and measures, training and organizational readiness.
+Added: Two of the members of the Audit Committee have obtained a certification or completed coursework in cybersecurity.
+Added: The Audit Committee, at least quarterly, receives reports from the Company’s Senior Director – Information Technology (“SDIT”) on, among other things, the Company’s cybersecurity incidents, risks, threats and measures, training and organizational readiness.
The board of directors is kept apprised of cybersecurity risk matters, including through participation in the quarterly cybersecurity briefings to the Audit Committee that are described above.
3 unchanged sentences
The SDIT has extensive cybersecurity knowledge and skills, gained from over 25 years of relevant work experience.
−Removed: The SDIT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in accordance with the CIRP and policies and procedures, which may include reports from the IT team.
+Added: The SDIT is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents in accordance with the CIRP, which may include reports from the IT team.
The SDIT also regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks.
Third Parties and Assessments :
−Removed: We engage third-party service providers in various capacities to enhance our internal cybersecurity capabilities.
−Removed: The Company engages consultants to assist with cybersecurity assessments, including with respect to cloud security and network vulnerability testing.
−Removed: Internal Audit, along with other internal stakeholders, including IT, determine the Company’s need for cybersecurity assessments in conjunction with an annual cybersecurity risk assessment process.
−Removed: Further, pursuant to our CIRP, we have engaged third-party support under a retainer agreement to enable an effective and timely response to a significant cybersecurity incident.
+Added: We engage third-party service providers in various capacities to strengthen our cybersecurity posture.
+Added: The Company works with external consultants to conduct cybersecurity assessments, which may include evaluations of cloud security, network vulnerabilities and other areas of cyber risk.
+Added: Our IT department, along with other key stakeholders, including Internal Audit, determines the need, scope and frequency of these assessments based on the Company's cybersecurity risk evaluation process.
+Added: Further, pursuant to our CIRP, we may engage third-party support to enable an effective and timely response to a significant cybersecurity incident.
In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers .
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.