10 unchanged sentences
Cybersecurity represents an important component of the Company's overall approach to enterprise risk management and is integrated into the risk management process and ongoing assessment.
−Removed: In addition to an internal security program, we strive to stay ahead of the threat landscape by working to conduct due diligence on key third-party vendors' Information Security programs and risks.
+Added: In addition to an internal security program, we strive to stay ahead of the threat landscape by actively monitoring and conducting due diligence on key third-party vendors' Information Security programs and risks.
+Added: This includes qualitative assessments to gain a deeper understanding of their security posture and potential vulnerabilities.
We make strategic investments in our perimeter and internal defenses, cyber security operations center, and regulatory compliance activities with the advice of consultants and third parties .
1 unchanged sentence
Vistra's Chief Information Officer (CIO) ensures Information Security is built into the Company's larger technology strategy and oversees our Chief Information Security Officer (CISO).
−Removed: Our CISO and his Information Security team are responsible for leading the enterprise-wide information security strategy, policy, standards, architecture, and processes and our Cyber Incident Response Teams under the CISO are responsible for monitoring and analyzing the Company's cybersecurity posture in partnership with Risk and Legal.
+Added: Our CISO and his Information Security team are responsible for leading the enterprise-wide information security strategy, policy, standards, architecture, and processes.
+Added: Additionally, our Cyber Incident Response Teams under the CISO are responsible for monitoring and analyzing the Company's cybersecurity posture in partnership with Risk and Legal.
The CIO and CISO collaborate with our internal audit department and external consultants to review information technology-related risks (based upon the National Institute of Standards and Technology (NIST) Cybersecurity Framework) as part of the overall Vistra cyber risk management process.
9 unchanged sentences
Risk Factors .
−Removed: While the Board has established a separate Risk and Sustainability Committee to oversee enterprise risk processes, the Board maintains oversight of Vistra's Information Security.
−Removed: Vistra engaged a third-party advisor to provide cybersecurity oversight and tabletop training to the full Board in 2023 to further our commitment to responsible oversight of cybersecurity risk management.
+Added: The Sustainability and Risk Committee of the Board has been delegated oversight responsibility of Vistra's Information Security.
+Added: Vistra periodically engages third-party advisors to provide cybersecurity oversight and tabletop training to the full Board to further our commitment to responsible oversight of cybersecurity risk management.
At least quarterly, our CIO reports to the Board on our Information Security program, including cybersecurity risks and threats (including the emerging threat landscape), an assessment of our Information Security program, and the status of projects to strengthen our Information Security program.
3 unchanged sentences
Pepper Inc., General Motors, Pfizer, and Electronic Data Systems.
−Removed: Our CISO also has over 35 years of information technology experience.
−Removed: He is a 10-year U.S.
−Removed: Air Force veteran and has held technology positions in infrastructure management and operations with Raytheon and Blockbuster.
−Removed: He also maintains Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM) certifications.
+Added: Our CISO has over 23 years of information technology experience.
+Added: He has held technology positions across various areas — including infrastructure management, application management, architecture, operations, and cybersecurity — and brings expertise from Farmers Insurance and Zurich Insurance.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.