3 unchanged sentences
Risk Management and Strategy
−Removed: The Company’s operations rely on the secure processing, storage, and transmission of confidential and personal identifiable
−Removed: information within various technology platforms.
+Added: The Company’s operations rely on the secure processing, storage, and transmission of confidential and personal identifiable information within various technology platforms.
Cybersecurity is a high priority and the Company has made significant investments in its processes and programs designed to prevent, detect, and respond to and recover from cybersecurity threats.
−Removed: We also have processes in place to help ensure compliance with our information security program with respect to our use of third-party service providers.
+Added: We also have processes in place to help ensure compliance with our information security program with respect to our use of third-party service providers, including review of vendor certifications, execution of appropriate data protection agreements, and contractual security requirements.
+Added: The Company is actively maturing its third-party risk management program to establish risk-based vendor tiering, due diligence standards, and ongoing monitoring controls for vendors.
+Added: The Company’s cybersecurity program is structured around the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”), which guides our approach to identifying, protecting, detecting, responding to, and recovering from cybersecurity risks.
+Added: The Company maintains an active cybersecurity roadmap aligned to NIST CSF to continuously mature its security posture and address identified risks.
Such processes and programs are a part of the Company’s overall risk management and compliance programs.
−Removed: The Company continues to enhance
−Removed: its intrusion protection and detection technology, infrastructure and application firewalls, and network monitoring.
−Removed: The Company has also installed advanced endpoint threat protection technology and implemented a mandatory security awareness
−Removed: training program for all employees.
+Added: The Company continues to enhance its intrusion protection and detection technology, infrastructure and application firewalls, and network monitoring.
+Added: The Company has also installed advanced endpoint threat protection technology and implemented a mandatory security awareness training program for all employees.
+Added: The Company enforces multi-factor authentication and least-privilege access principles across critical systems.
+Added: The Company has identified its current network architecture as an area of elevated risk and is actively executing a cybersecurity roadmap, aligned to the NIST CSF, to transition to a segmented, enterprise-grade network infrastructure.
+Added: This initiative includes the replacement of end-of-life network equipment and the implementation of network segmentation controls to reduce lateral movement risk.
This training is reinforced through periodic simulated phishing tests to assess our employees’ responses to suspicious emails.
−Removed: The Company uses a sophisticated backup and recovery methodology that supports the replication of data across multiple secure data
−Removed: It also includes a comprehensive disaster recovery plan that is continually tested and designed to help enable us to resume business in the event of a disaster or cybersecurity incident.
−Removed: Through recurring internal and external audits,
−Removed: controls are regularly reviewed, tested, and enhanced to promote best practices.
−Removed: The Company has augmented our information security program through a partnership with a leading global cybersecurity service provider to review and implement additional services such as Security Event Monitoring, Advanced Endpoint Threat Detection, Incident Management Retainer Services, and
−Removed: Strategic Advisory Services focused on Chief Information Security Officer (CISO) duties such as counter-threat intelligence.
+Added: The Company maintains backup and recovery capabilities designed to help enable us to resume business in the event of a disaster or cybersecurity incident.
+Added: The Company has identified resilience and recovery as a key area of focus within its cybersecurity roadmap and is actively working toward implementing cloud-enabled Business Continuity and Disaster Recovery (“BCDR”) with validated, tested recovery objectives designed to meet applicable BCDR compliance requirements.
+Added: Through recurring internal audits, controls are regularly reviewed, tested, and enhanced to promote best practices.
+Added: The Company recognizes ransomware and software supply chain compromises as significant threat vectors and is implementing controls including vendor integrity validation, and rapid isolation protocols as part of its evolving incident response capabilities.
+Added: The Company has augmented our information security program through a partnership with a leading global cybersecurity service provider to review and implement additional services such as Security Event Monitoring, Advanced Endpoint Threat Detection, Incident Management Retainer Services, and Strategic Advisory Services focused on Chief Information Officer (“CIO”) duties such as counter-threat intelligence.
Our information security program also includes a cybersecurity Incident Response Plan (“IRP”) that is designed to help protect the integrity, availability and confidentiality of information, prevent loss of service, and comply with legal requirements.
1 unchanged sentence
The IRP also includes processes for determining the materiality of the incident, including the assessment of relevant qualitative and quantitative factors.
+Added: Upon identifying a potential cybersecurity incident, the Company follows a structured assessment process to determine materiality and, where applicable, fulfill its obligation to disclose such incident in accordance with SEC rules.
In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined procedures for responding to such issues, including procedures that address when and how to engage with Company management, our board of directors, third-party advisors and other stakeholders.
1 unchanged sentence
post breach event remediation costs;
−Removed: cybercrime coverage (including financial fraud, telecommunications fraud, and phishing attacks);
+Added: cybercrime coverage (including financial fraud,
+Added: telecommunications fraud, and phishing attacks);
and coverage for system failure, bricking loss, and physical damage.
−Removed: The policy also provides coverage for lost revenue due to a damaged reputation
−Removed: from a cyber breach.
−Removed: We do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.
−Removed: Our board of directors recognizes the important role of information security and mitigating cybersecurity and other data security
−Removed: Although our full board of directors maintains ultimate responsibility with respect to risk management oversight, our board has delegated oversight of the Company’s information
−Removed: security program and matters of cybersecurity to the Audit Committee of the board of directors.
−Removed: The Company’s senior officers, including its Chief Information Officer, are responsible for the operation of the information security program and regularly communicate with the Audit Committee on the state of the program, risks faced by the Company and the Company’s risk mitigation efforts
−Removed: related thereto.
−Removed: In addition, the Company’s information technology environment is managed by an experienced team of professionals who follow an
−Removed: extensive set of policies and procedures related to data security.
+Added: The policy also provides coverage for lost revenue due to a damaged reputation from a cyber breach.
+Added: While no cybersecurity incidents have materially affected or are reasonably likely to materially affect our operations to date, there can be no assurance that future incidents will not have a material impact on the Company’s business, financial condition, or results of operations.
+Added: Our board of directors recognizes the important role of information security and mitigating cybersecurity and other data security threats.
+Added: Although our full board of directors maintains ultimate responsibility with respect to risk management oversight, our board of directors has delegated oversight of the Company’s information security program and matters of cybersecurity to the Audit Committee of the board of directors.
+Added: The Audit Committee receives regular briefings from the CIO on the state of the cybersecurity program, emerging threats, and the Company’s risk mitigation progress against its cybersecurity roadmap.
+Added: The Company’s senior officers, including its CIO, are responsible for the operation of the information security program and regularly communicate with the Audit Committee on the state of the program, risks faced by the Company and the Company’s risk mitigation efforts related thereto.
+Added: The Company’s CIO, supported by a dedicated information security team, is responsible for the day-to-day management of the information security program and regularly briefs the Audit Committee on cybersecurity risks, program status, and risk mitigation efforts.
+Added: In addition, the Company’s information technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security.
Our data security employees have backgrounds in cybersecurity and data protection, including prior relevant experience in the industry and industry standard certifications.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.