19 unchanged sentences
We have several dedicated teams of cybersecurity specialists, including teams focused on executing internal and external vulnerability and penetration assessments, designing secure systems and applications, monitoring for intrusions and providing incident response.
−Removed: In recent years, we have made significant investments in technology insourcing and reassumed direct ownership of certain information security related teams and functions.
+Added: We have made significant investments in technology insourcing and reassumed direct ownership of certain information security related teams and functions.
We have an ongoing cybersecurity training program for designated employees and contractors which addresses, among other things, our cybersecurity risk management processes, overall cybersecurity awareness and industry cybersecurity best practices.
8 unchanged sentences
• Incident Response Plan.
−Removed: We maintain an incident response plan that sets forth immediate response actions, internal and external communication protocols, stakeholder involvement based on the nature of the incident and post-incident
−Removed: analysis processes.
+Added: We maintain an incident response plan that sets forth immediate response actions, internal and external communication protocols, stakeholder involvement based on the nature of the incident and post-incident analysis processes.
The incident response plan designates an incident response team that is responsible for managing and executing response activities in coordination with subject matter experts and other stakeholders in the event of an incident.
8 unchanged sentences
• Cybersecurity Insurance.
−Removed: We maintain cyber risk insurance coverage that is intended to mitigate the financial impact of cybersecurity and data privacy incidents experienced by the Company and the Wendy’s system in the U.S.
+Added: We maintain cyber risk insurance coverage that is intended to mitigate the financial impact of cybersecurity and data privacy incidents.
There can be no assurance that our cyber insurance policies will be sufficient in scope or amount to cover the costs and expenses related to any future incidents.
+Added: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.
+Added: However, as described above, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.
+Added: For additional information about these risks, see “Item 1A.
+Added: Risk Factors—Risks Related to Technology and Cybersecurity” of this Form 10-K.
Cybersecurity Governance
14 unchanged sentences
Our CISO reports to the CIO and directs, coordinates, plans and organizes information security activities throughout the Company, including leading the development of our cybersecurity risk management strategy.
−Removed: The CISO possesses academic and industry certifications and experience in leading and managing information security programs, modernization and risk remediation work with multiple global companies, in addition to expertise in state and federal law enforcement cyber investigations.
+Added: The CISO possesses academic and industry certifications and approximately two decades of experience in technology risk management, including over a decade with the Company leading multiple information security functions.
The CISO briefs the CIO regularly on current cybersecurity matters and relevant issues across the cybersecurity threat landscape.
−Removed: The CIO and CISO regularly report to our senior leadership team, as well as our Board of Directors and designated Board committees, regarding our cybersecurity risk
−Removed: management strategy.
+Added: The CIO and CISO regularly report to our senior leadership team, as well as our Board of Directors and designated Board committees, regarding our cybersecurity risk management strategy.
The CIO and CISO are supported by several dedicated teams of cybersecurity specialists, including teams responsible for vulnerability and penetration assessments, secure design of systems and applications, intrusion detection and monitoring and incident response.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.