2 unchanged sentences
Risk Management and Strategy
−Removed: Aquestive’s cybersecurity program is built on four key pillars:
−Removed: Governance, Process, Compliance and Audit.
−Removed: While we face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, and results of operations, Aquestive’s cybersecurity program is built upon a set of policies, procedures, and standards supported by training and awareness.
−Removed: In addition, cybersecurity risks are also reviewed as part of our overall Enterprise Risk Management program.
−Removed: The cybersecurity team has significant experience in managing cybersecurity programs and has engaged with a MSSP to deploy state of the art cybersecurity technologies and gather threat intelligence and cyber risk trends.
−Removed: The cybersecurity program is executed with the MSSP, which provides active threat monitoring, risk assessment and incident response capabilities to timely assess and address any material cyber risk that could impact our business operations.
−Removed: On occasion, we engage other external experts, including cybersecurity assessors, consultants, and auditors to evaluate cybersecurity measures and risk management processes, including those applicable to Aquestive.
−Removed: We depend on and engage various third parties, including suppliers, vendors, and service providers, to operate.
−Removed: We rely on the expertise of our risk management, legal, information technology, and compliance personnel, as well as our MSSP, when identifying and overseeing risks from cybersecurity threats associated with our use of such entities.
+Added: Aquestive maintains a cybersecurity risk management program designed to identify, assess, and mitigate risks from cybersecurity threats that could materially affect the Company’s business operations, financial performance, or the confidentiality, integrity, and availability of Company data and information systems.
+Added: The Company’s cybersecurity program is organized around four pillars—Governance, Process, Compliance, and Audit—and is supported by formal written policies, procedures, and standards, including the Company’s Information Technology Policy and Cybersecurity Policy (collectively, the “Cybersecurity Policies”) that are assessed and evolving to address advancements in technology including artificial intelligence.
+Added: The Cybersecurity Policies establish required security controls and requirements relating to, among other things, system access, acceptable use, software acquisition, password management, and network security.
+Added: The Company also provides cybersecurity training and awareness programs, including training applicable to GxP and non‑GxP systems, as required under the Company’s Computer Policy.
+Added: The Company evaluates cybersecurity risk using processes aligned with recognized frameworks and standards, including the NIST CSF, applicable NIST Special Publications (including the 800 and 600 series), and ISO 42001.
+Added: The Company maintains an Incident Response Plan that is aligned to the NIST incident response lifecycle and is designed to support a consistent approach to cybersecurity events, including preparation, identification, containment, eradication, recovery, and lessons learned.
+Added: The Company’s cybersecurity monitoring activities include, among other things, review of system logs, authentication activity, endpoint security events, and network behavior.
+Added: These activities are supported by internal resources and a third‑party MSSP.
+Added: The MSSP supports the Company with active threat monitoring, threat intelligence, risk assessment processes, and incident response capabilities intended to enable the Company to assess and address cybersecurity risks that could impact business operations.
+Added: The Company may also engage other external experts, including cybersecurity assessors, consultants, and auditors , from time to time to evaluate cybersecurity measures and the effectiveness of relevant risk management processes.
+Added: The Company relies on third parties, including suppliers, vendors, cloud platforms, and other service providers, in connection with its operations.
+Added: The Company reviews cybersecurity risks associated with third‑party relationships and maintains controls designed to restrict unauthorized access and to align with internal policy requirements.
+Added: While the Company’s processes are intended to reduce exposure to cybersecurity threats, no controls can eliminate all risk, and cybersecurity threats and threat actors continue to evolve.
+Added: Cybersecurity risks are also reviewed as part of the Company’s enterprise risk management program.
+Added: The Company assesses on an ongoing basis the potential impacts of cybersecurity risks and how such risks could materially affect the Company’s business strategy, results of operations, or financial condition.
+Added: During the reporting period, the Company did not identify any cybersecurity threats or incidents, including as a result of previous cybersecurity incidents, that it believes have materially impacted, or are reasonably likely to materially impact, the Company’s business strategy, results of operations, or financial condition.
Role of Management/ Board
−Removed: The Senior Vice President of Information Technology (the “IT Officer”), along with the broader Information Technology function, is responsible for assessing and managing Aquestive’s cybersecurity risk and informing senior management and the Audit Committee of the Board regarding cybersecurity risks and the prevention, detection, mitigation, and remediation of cybersecurity incidents.
−Removed: The IT Officer reports to the Chief Executive Officer and leads our cybersecurity program.
−Removed: Our IT Officer has been responsible for this function at Aquestive for 10 years and has over eleven years of experience in information security strategy and the management of cybersecurity risk.
−Removed: The internal Aquestive IT team has over fifteen years of technical experience, program management and architecture experience in managing cyber risk and information security.
−Removed: The Audit Committee of the Board provides strategic oversight of Aquestive’s cybersecurity matters, including risks associated with cybersecurity threats .
−Removed: The IT Officer briefs the Audit Committee on the effectiveness of Aquestive's cybersecurity program quarterly with a more in depth review done annually.
−Removed: The potential impact of risks from cybersecurity threats on the Company are assessed on an ongoing basis, and how such risks could materially affect the Company’s business strategy, operational results, and financial condition are regularly evaluated.
−Removed: During the reporting period, we have not identified any risks from cybersecurity threats or incidents, including as a result of previous cybersecurity incidents, that we believe have materially impacted, or are reasonably likely to materially affect, the Company, including our business strategy, operational results, and financial condition.
+Added: The Chief People Officer , together with the broader information technology function, is responsible for assessing and managing the Company’s cybersecurity risks and for informing senior management and the Audit Committee regarding cybersecurity risks and the prevention, detection, mitigation, and remediation of cybersecurity incidents.
+Added: The Chief People Officer reports to the Company’s Chief Executive Officer and leads the Company’s cybersecurity program.
+Added: The Chief People Officer has served in this function at the Company for 10 years and has over eleven years of experience in information security strategy and cybersecurity risk management.
+Added: The Company’s internal information technology team has over fifteen years of combined technical, program management, and architecture experience in managing cyber risk and information security.
+Added: The Company’s Cybersecurity Policy and Incident Response Plan assign responsibilities for incident governance, including to the CSIRT, Incident Response Commander, Incident Response Manager, and Incident Handling Team.
+Added: These documents also establish escalation pathways and decision‑making authority during cybersecurity events.
+Added: The Company’s leadership, including the Director of IT and senior executives identified in the incident response governance matrix, are responsible for reviewing cybersecurity risks, approving responses to significant incidents, and ensuring the Company maintains appropriate resources for cybersecurity operations and continuous improvement consistent with the Company’s framework‑aligned processes.
+Added: Board Oversight of Cybersecurity Risk
+Added: The Audit Committee provides oversight of the Company’s cybersecurity matters, including risks associated with cybersecurity threats.
+Added: The IT Officer briefs the Audit Committee quarterly regarding the effectiveness of the Company’s cybersecurity program, with a more in‑depth review conducted annually.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.