7 unchanged sentences
Our cybersecurity program leverages the NIST Cybersecurity Framework to help protect the Company’s operations, information, production systems and networks from threats through cybersecurity practices, programs and tools that establish defenses in depth.
−Removed: The cybersecurity program includes, among other items, vulnerability and patch management, network and data segmentation, application of zero-trust principles, automated ingestion of multi-source threat intelligence, end point and network detection/response, application security, secure configurations for operating systems and databases, continuous security monitoring and 24/7 security operations.
−Removed: The program has dedicated business resilience, insider threat and governance, risk and compliance (GRC) functions.
+Added: The cybersecurity program includes, among other items, vulnerability and patch management, segmentation, identity and access management, application of zero-trust principles, automated ingestion of multi-source threat intelligence, end point and network detection/response, application security, secure configurations for operating systems and databases, continuous security monitoring and 24/7 security operations.
+Added: The program has dedicated business resilience, insider threat and governance, risk and compliance (“GRC”) functions that report to our Chief Information Security Officer (“CISO”).
Incident management is governed by our Incident Response Plan that assigns incident command and control parameters and escalation protocols to management and the Board of Directors.
Our cybersecurity program also focuses on risks from the use of third-party services.
−Removed: Our GRC team assesses the cybersecurity practices of current and prospective service providers for compliance with our requirements, and our procurement functions seek terms and conditions, including by example, audit rights and vulnerability or breach disclosure obligations, to enhance our defenses against supply chain risks.
+Added: Our GRC team assesses the cybersecurity practices of current and prospective service providers for compliance
+Added: with our requirements, and our procurement functions seek terms and conditions, including by example, audit rights and vulnerability or breach disclosure obligations, to enhance our defenses against supply chain risks.
Our cybersecurity program incorporates several control and best practice regimes, including for example, the Center for Internet Security (“CIS”) controls.
We conduct regular internal and external assessments, audits, and tabletop exercises to assess security vulnerabilities, control compliance and incident preparedness.
−Removed: These assessments and exercises include, for example, red team exercises simulating external attacks, crisis management exercises, including incident response, and internal audit reviews.
+Added: These assessments and exercises include red team exercises simulating external attacks, threat and vulnerability assessments, ransomware, application, and secure image testing, crisis management exercises, including incident response, and internal audit reviews.
Management and the Board’s Cybersecurity Committee reviews the results of these exercises, audits and assessments.
2 unchanged sentences
Our cybersecurity program also includes employee and contractor training, which primarily consists of monthly educational videos, annual trainings and certifications, and phishing exercises.
−Removed: Our cybersecurity strategy and program are led by our Executive Vice President and Chief Security Officer (CSO), who reports to the CEO.
−Removed: Our CSO is Danny McPherson, who has over 25 years of experience in technology and cybersecurity leadership positions and has authored several security-related books and numerous patents, IP standards, and security research publications.
+Added: Our cybersecurity strategy and program are led by our Executive Vice President of Technology and Chief Security Officer (“CSO”) , who reports to the CEO.
+Added: Our CSO has over 25 years of experience in technology and cybersecurity leadership positions and has authored several security-related books and numerous patents, IP standards, and security research publications.
He has served in various capacities on various technology working groups and standards setting organizations including the Internet Architecture Board and the Internet Engineering Task Force .
−Removed: Our CSO manages a converged security, engineering and operations organization that helps to ensure that cyber and other security priorities are appropriately integrated throughout the Company.
−Removed: Our Chief Information Security Officer, Chief Information Officer and the head of architecture and engineering report to our CSO.
+Added: Our CSO manages a converged security, engineering and operations organization that helps to ensure that cyber and other security priorities are appropriately integrated throughout technology and operations, as well as more broadly across the Company.
+Added: Our CISO, Chief Information Officer (“CIO”), Chief Technology Officer (“CTO”) and the head of architecture and engineering report to our CSO.
These and other experienced employees lead the teams responsible for implementing various parts of our cybersecurity program.
−Removed: In addition, a management-level Safety and Security Council (“Council”) chaired by our CEO and comprised of our CSO and other senior officers, provides cross-functional coordination for the management of the Company’s security functions.
+Added: In addition, a management-level Safety and Security Council (“Council”) chaired by our CEO and comprised of our CSO, General Counsel, and other senior officers, provides cross-functional coordination for the management of the Company’s security functions.
The Council receives information, typically monthly, on the status of the cybersecurity program, initiatives, incidents, cybersecurity risks, assessments, and threats, among other items.
4 unchanged sentences
The Committee operates pursuant to a written charter and calendar, each of which are reviewed on an annual basis.
−Removed: The Cybersecurity Committee and the full Board receive quarterly status reports on the cybersecurity program from the CSO, addressing progress and updates on various cybersecurity functions and initiatives including, for example, compliance, assessments, security operations and incident response, business resilience, distributed denial of service attacks, data privacy, technology and asset management, controls, and vulnerability management.
+Added: The Cybersecurity Committee and the full Board receive quarterly status reports on the cybersecurity program from the CSO, addressing progress and updates on various cybersecurity functions and initiatives including, for example, compliance, assessments, security operations and incident response, business resilience, DDoS attacks, data privacy, technology and asset management, controls, and vulnerability management.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.