6 unchanged sentences
We use established cybersecurity risk frameworks to identify, measure and prioritize cybersecurity risks and develop corresponding cybersecurity controls and safeguards, and we have implemented a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.
−Removed: Leveraging both internal and external resources, we conduct regular reviews and tests, including penetration testing as well as tabletop and red team exercises, to evaluate the effectiveness of our cybersecurity program, enhance our cybersecurity measures, and inform our planning.
+Added: Leveraging both internal and external resources, we conduct regular reviews and tests throughout the year, including penetration testing as well as tabletop and red team exercises, to evaluate the effectiveness of our cybersecurity program, enhance our cybersecurity measures, and inform our planning.
We periodically engage external auditors and consultants to assess our cybersecurity programs.
−Removed: We also maintain a risk-based approach to identifying and overseeing risks from cybersecurity threats associated with our use of third-party service providers.
+Added: We also maintain a risk-based approach to identifying and overseeing risks from cybersecurity threats associated with our use of third-party service providers which include security assessments and periodic reviews of certain providers including contractual information security and data protection requirements where appropriate.
In addition, we require Affirm employees to participate in cybersecurity awareness training.
4 unchanged sentences
Cybersecurity Governance
−Removed: Our Board of Directors has delegated authority to its Audit Committee to oversee risks associated with cybersecurity threats.
−Removed: Members of the Audit Committee receive updates periodically from our CISO regarding cybersecurity risks.
−Removed: These updates include, among other topics, reviews of existing and newly identified cybersecurity risks, status updates on how management is addressing and/or mitigating those risks, information about cybersecurity incidents (if any), as well as updates regarding the status of key cybersecurity initiatives.
+Added: Our Board of Directors oversees risks associated with cybersecurity threats and receives updates periodically from our CISO regarding cybersecurity risks.
+Added: These updates include, among other topics, cybersecurity program maturity progress, reviews of existing and newly identified cybersecurity risks (including AI risk), status updates on how management is addressing and/or mitigating those risks, information about cybersecurity incidents (if any), as well as updates regarding the status of key cybersecurity initiatives.
Our CISO is principally responsible for assessing and managing our cybersecurity risk management program, in partnership with leaders from our Technology, Information Security, Internal Audit, Legal and Compliance teams.
1 unchanged sentence
These individuals, including the CISO, are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.
−Removed: As discussed above, our CISO then makes periodic reports to the Audit Committee regarding such matters.
+Added: As discussed above, our CISO then makes periodic reports to the Board of Directors regarding such matters.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.