11 unchanged sentences
Each of the identified risks is given a risk classification from low to high depending on the probability of occurrence and the severity of impact.
−Removed: At least annually, we conduct tabletop exercises to simulate various attacks, enhancing our preparedness against potential threats.
−Removed: These tabletop exercises are conducted with the support of third-party cybersecurity experts.
+Added: At least annually, we test our incident response processes, enhancing our preparedness against potential threats.
+Added: These exercises are conducted with the support of third-party cybersecurity experts.
We perform continuous monitoring and detection of our systems, networks, and data repositories for suspicious activities by leveraging a third-party that provides 24x7 comprehensive monitoring of activity that is outside the normal patterns for our day-to-day operations.
10 unchanged sentences
We seek to require our third-party vendors contractually to maintain a level of security that is acceptable to us.
−Removed: We have not experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
+Added: We have not experienced any negative impacts from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or that we believe are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
We maintain specific insurance coverage to mitigate losses associated with certain cybersecurity incidents that impact our or our third parties’ information technology and information systems, but there can be no assurance that coverage would be adequate in relation to any incurred losses.
1 unchanged sentence
Cybersecurity Governance
−Removed: APEI’s Information Security Steering Committee, or the Steering Committee, consisting of the Chief Information Officer, Chief Information Security Officer, Chief Financial Officer, General Counsel, and the Chief Human Resources Officer, provides a level of oversight over our cybersecurity program.
+Added: APEI’s Information Security Steering Committee, or the Steering Committee, consisting of the Interim Chief Innovation and Technology Officer also acting as Chief Information Security Officer, Chief Financial Officer, General Counsel, and the Chief Human Resources Officer, provides a level of oversight over our cybersecurity program.
The Steering Committee meets quarterly and is briefed, among other things, on our cybersecurity program, how we are mitigating risks, any notable events that occurred, and phishing campaign results.
2 unchanged sentences
The Steering Committee is a critical element to review the cybersecurity program against applicable federal and state regulations and its progress for planned improvements.
−Removed: Our Chief Information Officer and Chief Information Security Officer have the primary responsibility for assessing and managing our material risks from cybersecurity threats.
−Removed: Both the Chief Information Officer and Chief Information Security Officer have extensive experience in running and managing a cybersecurity program both in commercial enterprises and government agencies.
−Removed: In assessing and managing our material risks from cybersecurity threats the Chief Information Officer and Chief Information Security Officer utilize real time monitoring tools, alerts, and dashboards, proactively hunt for threats, and assess capabilities through penetration testing and table top exercises, as well as access and utilize third party resources.
+Added: Our Interim Chief Innovation and Technology Officer has the primary responsibility for assessing and managing our material risks from cybersecurity threats.
+Added: T he Interim Chief Innovation and Technology Officer has extensive experience in running and managing a cybersecurity program both in commercial enterprises and government agencies.
+Added: In assessing and managing our material risks from cybersecurity threats the Interim Chief Innovation and Technology Officer utilizes real time monitoring tools, alerts, and dashboards, proactively hunt for threats, and assess capabilities through penetration testing and table top exercises, as well as access and utilize third party resources.
We have established structured processes and mechanisms, including incident reporting and escalation, and a comprehensive incident response and communication plan, in the event of a cybersecurity incident.
These plans consist of internal reporting and communication, including to the Chief Executive Officer, Chief Financial Officer, and General Counsel, and, as appropriate, management, as well as external reporting, including notifying the Board of Directors, and proper agencies as appropriate.
−Removed: The Chief Information Officer and the Chief Information Security Officer report significant risks from cybersecurity threats, the level of risk, and any material cybersecurity incidents to the Board of Directors, as well as annually review with the Board of Directors the budget, utilization of systems, processes, and controls in place to address cybersecurity risks and management.
−Removed: The Chief Information Officer and/or the Chief Information Security Officer update the Board of Directors no less than quarterly on significant developments in these areas.
+Added: The Interim Chief Innovation and Technology Officer reports significant risks from cybersecurity threats, the level of risk, and any material cybersecurity incidents to the Board of Directors, as well as annually review with the Board of Directors the budget, utilization of systems, processes, and controls in place to address cybersecurity risks and management.
+Added: The Interim Chief Innovation and Technology Officer updates the Board of Directors no less than quarterly on significant developments in these areas.
For more information on our information technology investments and their effects on our results of operations, refer to “Management’s Discussion and Analysis of Financial Condition and Results of Operations – Overview,” and for more information regarding risks related to our information technology, refer to “Risk Factors – Risks Related to Our Technology Infrastructure”.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.