5 unchanged sentences
We have developed what we believe to be a robust cybersecurity program that incorporates a process of identifying and managing cybersecurity risks across the enterprise.
−Removed: As part of our cybersecurity risk management process, we identify risk by reviewing the elements within our technology stack and processes, including a full scan and identification process of all APEI’s digital and physical assets within the organization, covering hardware, software, data, and personnel.
+Added: As part of our cybersecurity risk management process, we identify risk by reviewing the elements within our technology stack and processes, including a full scan and identification process designed to cover all APEI’s digital and physical assets within the organization, covering hardware, software, data, and personnel.
Assets are documented and assessed for their value, factoring in their significance and potential cost if compromised.
9 unchanged sentences
We also have an internal information technology audit team that routinely scans the environment and documents our compliance efforts with regulations and standards that govern our business, such as the Sarbanes-Oxley Act, the Payment Card Industry Data Security Standard (PCI-DSS), the Health Insurance Portability and Accountability Act, FERPA, and the Gramm-Leach-Bliley Act Safeguards Rule.
−Removed: We strive to make sure that the entire company is up to date with their responsibility and understand the importance of their contributions to staying cyber secure through a robust training and education program.
+Added: Cybersecurity threats continue to evolve with the use of emerging technologies, such as AI.
+Added: These threats can disrupt operations, compromise sensitive data, and erode trust.
+Added: We strive to make sure that employees and contractors are up to date with their responsibility and understand the importance of their contributions to staying cyber secure through a robust training and education program.
Employees and contractors are responsible for taking mandated cyber training on an annual basis.
−Removed: We also run phishing exercises on a routine basis to help ensure employees can recognize and report in appropriate activity and social engineering attempts.
+Added: We also run phishing exercises on a routine basis to help ensure employees and contractors can recognize and report inappropriate activity and social engineering attempts.
We have a process of continuous improvement by incorporating lessons learned from attempted attacks and feedback from phishing exercises, among other learnings.
5 unchanged sentences
Cybersecurity Governance
−Removed: In 2019, APEI established the Information Security Steering Committee, or the Steering Committee, consisting of the Chief Executive Officer, Chief Financial Officer, Chief Information Officer, Chief Information Security Officer, General Counsel, and other members of the legal team, to establish and provide oversight over our cybersecurity program.
+Added: APEI’s Information Security Steering Committee, or the Steering Committee, consisting of the Chief Information Officer, Chief Information Security Officer, Chief Financial Officer, General Counsel, and the Chief Human Resources Officer, provides a level of oversight over our cybersecurity program.
The Steering Committee meets quarterly and is briefed, among other things, on our cybersecurity program, how we are mitigating risks, any notable events that occurred, and phishing campaign results.
In addition, the Steering Committee reviews the program for the proper funding and staffing of the information technology security department as well as alignment of the program with our strategic objectives.
−Removed: The Steering Committee reviews and ratifies security policies and helps ensures the proper controls are in place and being followed.
+Added: The Steering Committee reviews and ratifies security policies and helps ensure the proper controls are in place and being followed.
The Steering Committee is a critical element to review the cybersecurity program against applicable federal and state regulations and its progress for planned improvements.
−Removed: Our cybersecurity program is overseen by the Chief Information Officer and Chief Information Security Officer.
−Removed: Both the Chief Information Officer and Chief Information Security Officer have extensive experience in running and managing a cybersecurity program both in civilian and government agencies.
−Removed: We have established structured processes and mechanisms, including incident reporting and escalation, a comprehensive incident response plan, and communication plans, in the event a vulnerability is exploited or an attack is successful.
−Removed: These communication plans consist of internal reporting and communication, including to the Chief Information Officer and the Chief Information Security Officer, as well as external reporting, including notifying the proper agencies, management, and the Board of Directors.
−Removed: The Chief Information Officer and the Chief Information Security Officer report the risks from cybersecurity threats, the level of risk, and any material cybersecurity incidents to the Board of Directors, as well as annually review with the Board of Directors the budget, utilization of systems, processes, and controls in place to address cybersecurity risks and management.
−Removed: The Chief Information Officer and/or the Chief Information Security Officer update the Board of Directors no less than quarterly on material developments in these areas.
+Added: Our Chief Information Officer and Chief Information Security Officer have the primary responsibility for assessing and managing our material risks from cybersecurity threats.
+Added: Both the Chief Information Officer and Chief Information Security Officer have extensive experience in running and managing a cybersecurity program both in commercial enterprises and government agencies.
+Added: In assessing and managing our material risks from cybersecurity threats the Chief Information Officer and Chief Information Security Officer utilize real time monitoring tools, alerts, and dashboards, proactively hunt for threats, and assess capabilities through penetration testing and table top exercises, as well as access and utilize third party resources.
+Added: We have established structured processes and mechanisms, including incident reporting and escalation, and a comprehensive incident response and communication plan, in the event of a cybersecurity incident.
+Added: These plans consist of internal reporting and communication, including to the Chief Executive Officer, Chief Financial Officer, and General Counsel, and, as appropriate, management, as well as external reporting, including notifying the Board of Directors, and proper agencies as appropriate.
+Added: The Chief Information Officer and the Chief Information Security Officer report significant risks from cybersecurity threats, the level of risk, and any material cybersecurity incidents to the Board of Directors, as well as annually review with the Board of Directors the budget, utilization of systems, processes, and controls in place to address cybersecurity risks and management.
+Added: The Chief Information Officer and/or the Chief Information Security Officer update the Board of Directors no less than quarterly on significant developments in these areas.
For more information on our information technology investments and their effects on our results of operations, refer to “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Overview,” and for more information regarding risks related to our information technology, refer to “Risk Factors – Risks Related to Our Technology Infrastructure”.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.