9 unchanged sentences
Our security program under this framework utilizes policies, software, training programs and hardware solutions to protect and monitor our environment, including multi-factor authentication on all critical systems, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing and identity management systems.
−Removed: Our Chief Information Officer (“CIO”), who reports directly to the Chief Executive Officer, oversees the Company’s approach to managing cybersecurity and digital risk.
−Removed: Our CIO also regularly engages with cross-functional teams at the Company and partners with our dedicated technology risk management and privacy teams and collaborates with our internal audit department to review information technology-related internal controls as part of the overall internal controls process.
−Removed: Our information security strategic plan includes the development of a single detection and response team across both the corporate and product information and technology environments.
−Removed: We periodically conduct risk assessments to identify threats and vulnerabilities, and then determine the likelihood and impact for each risk using a qualitative risk assessment methodology.
−Removed: We identify risks from various sources, including vulnerability scans, penetration tests, vendor risk assessments, product and services audits, internal compliance assessments and threat-hunting operations.
−Removed: We monitor our infrastructure and applications to identify evolving cyber threats, scan for vulnerabilities and mitigate risks.
With oversight from our Board of Directors, the Company has formally adopted and annually updates a Security Incident Response Plan which coordinates the activities we undertake to prepare for, detect, respond to and recover from cybersecurity incidents.
−Removed: These activities include processes to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.
+Added: These activities include processes to triage, assess the severity of, escalate, contain, investigate, and remediate
+Added: incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.
Our incident response plan establishes a framework for measuring the severity of security incidents and provides for a post-market response program including protocols for coordination and communication between security response teams, designated leaders within the Company, internal and outside legal counsel, and the Audit and Finance Committee (“AFC”) of the Company’s Board of Directors in responding to any such incidents.
7 unchanged sentences
Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including the impact of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents.
−Removed: In the last three years, we have not experienced any material information security breach incidents.
+Added: In the last three years, we are not aware of having experienced any material information security breach incidents.
The Company maintains cybersecurity insurance, and as part of management oversight we regularly review our policy and levels of coverage based on current risks.
Management’s Role Managing Risk
−Removed: The cybersecurity risk management processes described above are managed by our CIO who reports directly to our Chief Executive Officer.
−Removed: Our CIO has over 20 years of experience in matters of cybersecurity and information systems including senior roles at other global publicly traded companies in various industries.
−Removed: Our CIO is a member of multiple professional organizations, and holds professional certifications from leading information, compliance, and privacy organizations.
+Added: The cybersecurity risk management processes described above are managed by our Chief Information Security Officer (“CISO”), who has over 20 years of experience in matters of cybersecurity and information systems including senior roles at other global publicly traded companies in various industries.
His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.
−Removed: Our CIO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.
−Removed: At the management level, our IT security team regularly monitors alerts and meets to discuss threat levels, trends and remediation, and the CIO is also continually informed about any developments in cybersecurity, including potential threats and industry techniques for risk management to address those threats.
−Removed: The role of the CIO includes implementation and oversight of effective processes to monitor our information systems, including the deployment of advanced security measures and regular system audits to identify potential vulnerabilities.
−Removed: The CIO regularly reports to senior management on our cybersecurity risks and actions taken to mitigate that risk.
+Added: Our CISO oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee training program.
Board of Directors Oversight
−Removed: Our Board of Directors is committed to mitigating data privacy and cybersecurity risks and recognizes the importance of these issues as part of our risk management framework.
−Removed: The AFC is charged with oversight of data privacy and cybersecurity risks.
−Removed: Our CIO provides updates to either the AFC or to the full Board of Directors on a quarterly basis on our cybersecurity risks and actions taken to mitigate that risk.
−Removed: These briefings encompass a broad range of topics, including:
+Added: Our Board of Directors is committed to mitigating data privacy and cybersecurity risks and has charged the AFC with oversight of data privacy and cybersecurity risks.
+Added: Our CISO provides updates to either the AFC or to the full Board of Directors on a quarterly basis on a broad range of topics, including:
• current cybersecurity landscape and emerging threats;
2 unchanged sentences
• updates on the Company’s performance preparing for, preventing, detecting, responding to and recovering from cyber incidents.
−Removed: The CIO also promptly informs and updates the Company’s Board of Directors about any information security incidents that may pose significant risk to the Company.
+Added: The CISO also promptly informs and updates the Company’s Board of Directors about any information security incidents that may pose significant risk to the Company.
Our guidelines require that any significant cybersecurity matters, including strategic risk management decisions, are escalated to the Board of Directors to ensure that they have comprehensive oversight.
−Removed: The AFC conducts an annual review of the Company’s cybersecurity posture and the effectiveness of its risk management strategies.
−Removed: As part of this review, the Company’s cybersecurity program is periodically evaluated by external experts, and the results of those reviews are reported to the Company’s Board of Directors.
−Removed: This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.
+Added: The AFC conducts an annual review of the Company’s cybersecurity posture and the effectiveness of its risk management strategies, including input from external experts, and the results of those reviews are reported to the Company’s Board of Directors.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.