3 unchanged sentences
Risk Management and Strategy
−Removed: We have in place a cross-functional, enterprise-wide cybersecurity program that is integrated into our overall risk management process and strategy and has direct involvement from our senior management and board oversight.
−Removed: Our cybersecurity program is based on industry standard CIS critical security controls.
−Removed: The top risks facing our Company, including those related to cybersecurity, are included in our overall enterprise risk management program that is managed by a cross-functional group chaired by our compliance and internal audit functions.
−Removed: To assess, identify, and manage material risks from cybersecurity threats to our information systems and the associated costs, our cybersecurity program prioritizes vulnerability management and risk reduction, detection and prevention.
+Added: We have in place a cross-functional, enterprise-wide cybersecurity program that is integrated into our overall enterprise risk management process and strategy and has direct involvement from our senior management and board oversight.
+Added: Our cybersecurity program is based on industry standards.
+Added: To assess, identify, and manage material risks from cybersecurity threats to our information systems and the associated costs, our cybersecurity program prioritizes using a risk-based approach that prevents and detects threats.
As part of this program, we conduct continuous monitoring for anomalous behavior using a third-party security operations center.
−Removed: In addition, we conduct an annual cybersecurity risk assessment in conjunction with our third-party consultant that specializes in information security, and we incorporate recommendations from the risk assessment into our cybersecurity strategy, as appropriate.
−Removed: This risk assessment process considers the nature of our business, requirements from our internal and external stakeholders, and industry trends and risks, including new and emerging risks.
−Removed: By continuously assessing the cybersecurity landscape, we develop targeted strategies that identify and address the risks most likely to impact our company.
+Added: In addition, we conduct an annual cybersecurity assessment in conjunction with our third-party consultant that specializes in information security, and we incorporate recommendations from the assessment into our cybersecurity strategy, as appropriate.
+Added: This assessment process considers the nature of our business, requirements from our internal and external stakeholders, and industry trends and risks, including new and emerging risks.
+Added: By continuously assessing the cybersecurity landscape, we develop targeted
+Added: strategies that identify and address the risks most likely to impact our company.
We also conduct at least one cybersecurity incident tabletop exercise each year to test and enhance our incident response plans.
Our cybersecurity program is designed to detect and prevent disruption to critical information systems, minimize the loss or manipulation of sensitive information, efficiently remediate and recover from cybersecurity incidents and ensure compliance with regulations and disclosure requirements.
−Removed: Pursuant to our processes, when a cybersecurity incident occurs, we convene a cross-functional incident response team whose membership is dictated by the severity of the incident but in all instances includes representatives from our information technology, legal and accounting departments.
+Added: Pursuant to our processes, when a cybersecurity incident occurs, we convene a cross-functional incident response team whose membership is dictated by the severity of the incident but in all instances includes representatives from our information technology, legal and finance departments.
This cross-functional representation allows us to leverage diverse perspectives and expertise when addressing cybersecurity events and to analyze the potential financial, legal, operational, and reputational implications of an incident, thereby enabling us to make informed decisions and take appropriate actions.
−Removed: This incident response framework further enables us to quickly assess the severity of cybersecurity incidents and the materiality of incidents based on pre-defined criteria that considers both quantitative and qualitative factors to determine the appropriate response.
−Removed: Identified incidents are then escalated to the relevant management teams based on their severity, allowing for a swift determination of materiality and an effective mitigation process.
+Added: This incident response framework further enables us to quickly assess the severity of cybersecurity incidents and support materiality determination of incidents based on pre-defined criteria that considers both quantitative and qualitative factors to determine the appropriate response.
If we determine that an incident is not material, we continue to monitor it for subsequent developments.
6 unchanged sentences
By equipping our employees with the necessary knowledge and skills, we intend to cultivate a cybersecurity-conscious culture within our organization.
−Removed: We maintain insurance to provide coverage for a portion of the losses and damages that may result from a physical attack, cybersecurity attack or a security breach.
−Removed: Such insurance is subject to several exclusions and may not cover the total loss or damage caused by an attack or a breach.
+Added: We maintain insurance to provide coverage for a portion of the losses and damages that may result from a range of cybersecurity incidents.
+Added: Such insurance is subject to several exclusions and may not cover the total loss or damage caused by an incident.
Consequently, costs related to incidents may not be covered by insurance.
5 unchanged sentences
While we have implemented measures to safeguard our operational and technology systems and have established a culture of monitoring and improvement, cybersecurity threats are constantly evolving, becoming more frequent and more sophisticated and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them.
−Removed: However, our management has determined that, during the period covered by this Annual Report on Form 10-K, no cybersecurity threats, including as a result of any previous cybersecurity incidents,
−Removed: have materially affected or are reasonably likely to materially affect our company, including our business strategy, operating results, or financial condition.
+Added: However, our management has determined that, during the period covered by this Annual Report on Form 10-K, no cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, operating results, or financial condition.
Our board of directors is responsible for cybersecurity risk management and oversight of our cybersecurity program.
−Removed: The nominating and corporate governance committee of the board of directors assists in the oversight of management’s implementation of our information technology policies and monitoring of the risks associated with our information systems, including reviewing and discussing with management our program to identify, assess, manage and monitor cybersecurity risks.
+Added: The nominating and corporate governance committee of the board of directors provides oversight of the program to identify, assess, manage and monitor cybersecurity risks.
The nominating and corporate governance committee regularly reviews technology strategies, physical and cybersecurity threat assessments, emerging issues and related initiatives.
2 unchanged sentences
Our board of directors delegates execution of our cybersecurity program to our chief information security officer , or CISO, who is responsible for the day-to-day management of our cybersecurity program.
−Removed: Our CISO has over 25 years of information security and information technology risk expertise in multiple industries, including financial, manufacturing, healthcare and life sciences, and holds industry standard certifications, including CISSP, CRISC and CISM.
−Removed: Our CISO, together with our Chief Information Officer, or CIO, provides at least two presentations each year to our board of directors or nominating and corporate governance committee on cybersecurity incidents, security program updates and ongoing risks, with additional updates being provided on an as-needed basis.
+Added: Our CISO has over 25 years of information security and information technology risk expertise in multiple industries, including defense, manufacturing, financial and life sciences, and holds industry standard certifications.
+Added: Our CISO, together with our chief information officer, or CIO, provides at least two presentations each year to our board of directors or nominating and corporate governance committee on, security
+Added: program updates and ongoing risks, with additional updates being provided on an as-needed basis.
Our CISO also meets periodically with our senior leadership team to review metrics on readiness, incidents, mitigations and remediation.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.