2 unchanged sentences
Information Security Risk Management and Strategy
−Removed: Our Board of Directors (“Board”) is responsible for overseeing risk management at Whirlpool, which is the responsibility of our Executive Vice President and Chief Financial Officer.
−Removed: Our risk management process is designed to identify, prioritize, and monitor risks that could affect our ability to execute our corporate strategy and fulfill our business objectives and to appropriately mitigate such risks.
+Added: Our Board is responsible for monitoring the Company’s key risks and overseeing the risk management structure and programs implemented by management.
+Added: At meetings throughout the year, the Board receives updates from business unit and functional leaders regarding significant risks and challenges within their areas of responsibility and associated mitigation plans and strategies.
+Added: The Chief Financial and Administrative Officer is responsible for the Company’s enterprise risk management (ERM) system, which helps ensure enterprise risks are being effectively managed.
+Added: Our ERM processes systematically identify, assess, mitigate and monitor enterprise risks, whether strategic, financial, non-financial, operational, compliance or reporting.
As part of our risk management processes, we perform risk assessments in which we map and prioritize information security risks identified through the processes described above, including risks associated with our use of third-party service providers, based on probability, immediacy and potential magnitude.
2 unchanged sentences
For more information regarding the information security-related risks we face, see the information in “Item 1A:
−Removed: Risk Factors” under the caption “We have been and may be subject to information technology system failures, network disruptions, cybersecurity attacks and breaches in data security, which may materially adversely affect our operations, financial condition and operating results”.
−Removed: Our risk mitigation process assesses, prioritizes, and monitors information security risks and vulnerabilities and helps ensure risk mitigation efforts are embedded across our business.
+Added: Risk Factors” under the caption “We have been and may be subject to information technology system failures, cloud failures, network disruptions, cybersecurity attacks and breaches in data security, which may materially adversely affect our operations, financial condition and operating results”.
+Added: Our risk mitigation process assesses, prioritizes, and monitors information security risks and vulnerabilities and focuses on embedment of risk mitigation efforts across our business.
Among other things, our internal experts regularly conduct audits and tests of our information systems and our cybersecurity program is periodically assisted by established, independent third party consultants, who provide assistance through tabletop and other preparedness exercises.
−Removed: We also review information security threat information published by government entities and other organizations in which we participate and actively engage with suppliers, industry associations, key thought leaders and law enforcement communities as part of our continuous efforts to evaluate and enhance the effectiveness of our cybersecurity program.
−Removed: In 2022, we launched and required all salaried employees to complete a mandatory Global Cybersecurity and Privacy training, covering information security, end-user security policies, remote working, phishing and email security and digital threats.
−Removed: This training was enhanced with additional topics in 2023 around social media, social engineering, and breach response, among others.
+Added: We also review information security threat information published by government entities and other
+Added: organizations in which we participate and actively engage with suppliers, industry associations, key thought leaders and law enforcement communities as part of our continuous efforts to evaluate and enhance the effectiveness of our cybersecurity program.
+Added: In 2022, we launched and required all salaried employees to complete a mandatory Global Cybersecurity and Privacy training, covering information security, end-user security policies, breach response, remote working, phishing and email security and digital threats.
+Added: The training content is reassessed and refreshed each year to reflect evolving risks.
Additionally, we maintain regular publications on cyber awareness on our Company portal and conduct ongoing simulated phishing exercises.
We use the findings from these and other processes to improve our information security practices, procedures and technologies.
−Removed: In 2023, we implemented additional management governance through the creation of a Global Cybersecurity and Data Privacy Steering Committee, which meets periodically to help ensure information security risks and vulnerabilities are being appropriately managed and mitigated.
+Added: In 2023, we implemented additional management governance through the creation of a Global Cybersecurity and Data Privacy Steering Committee, which meets periodically to review information security risks and vulnerabilities are being appropriately managed and mitigated.
In addition, we maintain insurance to protect against potential losses arising from an information security incident.
2 unchanged sentences
In addition to the risk management processes identified above, Whirlpool also maintains active knowledge security and data privacy programs.
−Removed: Leveraging policies and governance, ongoing
−Removed: training and awareness as well as strong controls and systems-based approaches, these programs help ensure that Whirlpool confidential information is protected and that the company complies with applicable data privacy and data protection laws in all countries where we do business.
+Added: Leveraging policies and governance, ongoing training and awareness as well as strong controls and systems-based approaches, these programs focus on protecting Whirlpool confidential information and compliance with applicable data privacy and data protection laws in all countries where we do business.
Information Security Governance and Oversight
11 unchanged sentences
The Plan includes processes to triage, assess severity of, escalate, contain, investigate and remediate information security incidents, including those associated with our third-party service providers, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.
−Removed: Under the Plan, the CIRT may escalate matters as necessary to our CISO and CIO, Chief Legal Officer, and other senior leadership, depending on the severity classification of the incident.
+Added: Under the Plan, the CIRT may escalate matters as necessary to our CISO and CIO, General Counsel, and other senior leadership, depending on the severity classification of the incident.
In addition to the ordinary-course Board and Audit Committee reporting and oversight described above, we also maintain disclosure controls and procedures designed for prompt reporting to the Board and timely public disclosure, as appropriate, of material events covered by our risk management framework, including information security risks.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.