14 unchanged sentences
While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CISO or another member of the dedicated cybersecurity team, and will include other information technology and legal personnel.
−Removed: The incident response team regularly reports to senior management, including the CEO, CFO, COO and CLO in the event of a potentially significant cybersecurity incident.
+Added: The incident response team regularly
+Added: reports to senior management, including the CEO, CFO, COO and CLO in the event of a potentially significant cybersecurity incident.
The CISO or another member of the incident response team also reports to the Company’s Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident and consists of senior officers in the operations, finance, and legal functions.
5 unchanged sentences
The Audit Committee provides regular briefings to the full board of trustees with respect to the Company’s cybersecurity program.
−Removed: Additionally, we provide an annual update on the cybersecurity program to the full board of trustees, which has included our CTO and third-party cybersecurity experts in recent years.
+Added: Additionally, we provide an annual update on the cybersecurity program to the full board of trustees, which has included our CTO, VP of Information Security and third-party cybersecurity experts in recent years.
As part of our board refreshment efforts in recent years we have focused on adding trustees with cybersecurity risk management experience.
15 unchanged sentences
Third-party IT vendors determined to present a higher risk are also subject to additional diligence such as questionnaires, inquiries, and review of System and Organization Controls (SOC) 1 and 2 reports, when relevant.
+Added: We recognize the risks that come with the use of AI technologies in our cybersecurity operations.
+Added: We have adopted a governance framework that requires proposed AI technologies to undergo a risk evaluation, assessing risks such as potential bias, privacy implications, and business impact, before deployment within the business.
+Added: This evaluation is conducted using defined criteria, including regulatory compliance and impact on business operations, and is performed by a cross-functional committee consisting of representatives from our business, legal, IT and cybersecurity teams.
+Added: Use cases that are approved for deployment are inventoried and periodically reviewed.
Detection and Analysis
2 unchanged sentences
Cybersecurity incidents may also be detected through a variety of means, which may include, but are not limited to, employee notification to our IT service center, notification from external parties (e.g., customers, vendors, or service providers), and automated event-detection notifications.
−Removed: Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the incident response plan follows the procedures set forth in the plan to investigate the potential incident, including classifying the nature and severity of the event.
+Added: Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the incident response plan
+Added: follows the procedures set forth in the plan to investigate the potential incident, including classifying the nature and severity of the event.
Potentially significant cybersecurity incidents are escalated to the Disclosure Committee, which makes determinations regarding SEC reporting obligations related to the cybersecurity incident.
11 unchanged sentences
Cybersecurity Risks
−Removed: As of December 31, 2024, we have not had any known instances of material cybersecurity incidents.
+Added: As of December 31, 2025, we have not had any known instances of material cybersecurity incidents, including third-party incidents, during any of the prior three fiscal years.
However, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging.
In addition, although the Company maintains cyber risk insurance to provide some coverage for certain risks arising out of data and network breaches, there can be no assurance that our cyber risk insurance coverage will be sufficient in the event of a cyber-attack.
−Removed: See “Risk Factors—Risks Related to our Business—If our confidential information is compromised or corrupted, including as a result of a cybersecurity incident, our business operations and reputation could be damaged, which could adversely affect our financial condition and operating results.”
+Added: See Part I, “Item 1A.
+Added: Risk Factors—Risks Related to our Business—If our confidential information is compromised or corrupted, including as a result of a cybersecurity incident, our business operations and reputation could be damaged, which could adversely affect our financial condition and operating results.”
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.