15 unchanged sentences
As part of our information security program, we have implemented a number of tools and procedures designed to identify and remediate vulnerabilities and misconfigurations in our applications and infrastructure, as well as manage access and identities throughout their lifecycles.
−Removed: These tools and procedures are intended to be consistent with ISO and NIST frameworks.
+Added: These tools and procedures
+Added: are intended to be consistent with ISO and NIST frameworks.
In addition, we have implemented an incident response policy that outlines established processes for addressing cybersecurity issues that leverages a cross-functional cybersecurity incident response team and outside advisors intended to allow the Company to take action in a timely and decisive manner in compliance with applicable laws, rules and regulations during the response, investigation and remediation of a given cybersecurity incident.
2 unchanged sentences
Our efforts in this regard consist of (among other efforts):
−Removed: (i) security assessments to determine whether key third-party service provider information security procedures meet our expectations, (ii) the use of a monitoring service that detects evidence of the compromise of key third-party provider systems, technology and infrastructure, (iii) assessments designed to identify business and technical risks to our systems, technology and infrastructure posed by key third-party service providers and (iv) the development of strategies to determine the potential adverse impact of, and develop mitigation strategies for, any cybersecurity incidents experienced by key third-party service providers on our business, financial condition and results of operations.
+Added: (i) security assessments to determine whether key third-party service provider information security procedures meet our expectations, (ii) the use of a monitoring service that detects evidence of the compromise of key third-party service provider systems, technology and infrastructure, (iii) assessments designed to identify business and technical risks to our systems, technology and infrastructure posed by key third-party service providers and (iv) the development of strategies to determine the potential adverse impact of, and develop mitigation strategies for, any cybersecurity incidents experienced by key third-party service providers on our business, financial condition and results of operations.
Education, training and preparedness efforts.
2 unchanged sentences
(i) protect our systems, technology, infrastructure and data from cybersecurity threats, (ii) quickly report known or suspected cybersecurity incidents or other suspicious activity through designated channels and respond effectively to such events and (iii) use Company and personal information technology in a secure manner.
−Removed: In addition, we generally mandate information security training for our employees and our software developers generally receive mandatory
−Removed: additional technical training, each on an annual basis.
+Added: In addition, we generally mandate information security training for our employees and our software developers generally receive mandatory additional technical training, each on an annual basis.
In connection with our preparedness efforts, we periodically participate in tabletop exercises with the goal of helping management effectively respond to cybersecurity incidents that may occur.
16 unchanged sentences
As discussed above and under Item 1A.
−Removed: Risk Factors—General Risk Factors, we face a number of cybersecurity risks across our various businesses, and we have experienced threats to and unauthorized intrusions of our systems, technology and infrastructure from time to time.
−Removed: While to our knowledge we have not, to date, experienced a cybersecurity incident or threat that has materially and adversely affected our business, financial condition and results of operations, we cannot provide assurances that they will not be materially affected in the future by such incidents.
+Added: Risk Factors—General Risk Factors, we face a number of cybersecurity risks across our various businesses, and from time to time we have experienced threats to and unauthorized intrusions of our systems,
+Added: technology and infrastructure.
+Added: Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident.
+Added: While we have implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties.
+Added: Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.