1 unchanged sentence
CYBERSECURITY
−Removed: XPO employs a robust system of information technology and information security controls and measures to assess, identify, and mange risks from cybersecurity threats which we consider to be critically important to maintaining our business and ensuring our business continuity.
−Removed: Our information security program is managed by a dedicated Chief Information Security Officer (“CISO”), whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, threat detection, and incident response processes.
−Removed: Our CISO has a background in cybersecurity and risk management, including assessing, designing, building and operating security platforms.
−Removed: He has over 10 years of information technology and information security experience having successfully built and led security programs on areas relating to cybersecurity, risk management, identity and access, data protection, product and software security, cyber engineering, cyber defense, automation, and compliance initiatives.
−Removed: The CISO, who reports directly to our Chief Information Officer, provides periodic reports to our Board of Directors, as well as our Chief Executive Officer, Chief Information Officer, and other members of our senior management as appropriate.
−Removed: Our CISO meets regularly with his team as well as other key personnel to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents and develop reports for our senior management.
+Added: XPO employs a robust system of information technology and information security controls and measures to assess, identify, and manage risks from cybersecurity threats which we consider to be critically important to maintaining our business and ensuring our business continuity.
+Added: Our information security program is overseen by our Chief Information Officer (“CIO”) , whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, threat prevention, threat detection, and incident response processes.
+Added: Our CIO has over 15 years of information technology and information security experience and he and his team have experience in cybersecurity and risk management, including assessing, designing, building and operating security platforms, identity and access, data protection, product and software security, cyber engineering, cyber defense, automation and compliance initiatives.
+Added: The information security team provides periodic reports to our CIO, Board of Directors, as well as our Chief Executive Officer and other members of our senior management as appropriate.
+Added: Our CIO meets regularly with his team as well as other key personnel to share information about potential cybersecurity events and monitor, prevent, and detect potential cybersecurity incidents and develop reports for our senior management.
These reports include updates on the Company’s cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, including the results of security breach simulations, and the emerging threat landscape.
1 unchanged sentence
The Board of Directors also discusses relevant incidents in the industry and the evolving threat landscape.
−Removed: As part of our information security program, our CISO and his team integrate our information security measures into our overall risk management processes to identify, evaluate, and quantify risks based on available information and classify the severity of potential cybersecurity incidents.
+Added: As part of our information security program, our CIO and his team integrate our information security measures into our overall risk management processes to identify, evaluate, and quantify risks based on internal and external available information and classify the severity of potential cybersecurity incidents.
XPO employs technical measures to protect against cybersecurity attacks that align with functions identified in the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework.
−Removed: The information security team continuously reviews our information security systems for unauthorized system access, cybersecurity incidents, and unusual traffic on our systems and meets regularly to identify, assess, and manage cybersecurity threats, including those posed by third-party service providers who provide services to our business.
+Added: The information security team continuously reviews our information security systems for unauthorized system access, cybersecurity incidents, indicators of compromise, and unusual traffic on our systems.
+Added: The information security leadership team meets regularly to ensure our processes to identify, assess, and manage cybersecurity threats, including those posed by third-party service providers who provide services to our business, are effective and current.
Our information security team also reviews relevant legislative and regulatory developments and conducts regular and tailored information security training for our global workforce, in various formats.
3 unchanged sentences
We conduct internal exercises to prepare our leadership and cross-functional teams to respond in the event of a cybersecurity incident and to help us test and consider revisions to our incident response procedures.
−Removed: We also actively engage with key consultants, auditors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security program.
+Added: We also actively engage with key consultants, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security program.
Our program is regularly evaluated by internal and external experts, with the results of those reviews reported to senior management and the Board of Directors.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.