3 unchanged sentences
The Company’s cybersecurity risk management program is an integral part of its overall enterprise risk management efforts.
−Removed: The Company manages cybersecurity risks within its products and services, infrastructure and corporate resources using a framework that is based on applicable regulations, industry standards and recognized best practices.
−Removed: Through this framework, the Company devotes significant resources to identifying, monitoring, assessing and responding to cybersecurity threats and incidents, including those associated with its use of third-party software, applications, services, and cloud infrastructure.
−Removed: To mitigate risk to its systems, endpoints and data, the Company evaluates internal and external threat intelligence, deploys encryption and authentication technologies and other protective measures, maintains security policies and procedures, and conducts vulnerability testing and awareness training.
−Removed: The Company also conducts penetration testing and other risk assessments, implements appropriate internal controls, and engages independent third-party auditors to evaluate its compliance with security compliance standards.
−Removed: The Company’s incident response team, comprised of representatives from the Company’s information technology, information security, product security, engineering, privacy and legal groups, is responsible for addressing data breaches, intrusions, and other security incidents and implementing the Company’s incident response plan.
−Removed: The Company’s incident response plan includes processes and procedures for assessing internal and external threats, escalation and activation, crisis management, and post-incident recovery.
−Removed: The readiness of the incident response team is promoted through table-top exercises and threat simulations.
−Removed: The Company also conducts mandatory training of all employees on its security practices and policies and periodically sends simulated phishing emails to employees to build resilience.
+Added: The Company manages cybersecurity risks within its products and services, infrastructure and corporate resources using a framework that is based on applicable regulations, industry standards and recognized best practices designed to safeguard the confidentiality, integrity, and availability of its information assets.
+Added: Through this framework, the Company devotes appropriate resources to monitoring, identifying, assessing and responding to cybersecurity threats and incidents, including those associated with its use of third-party software, applications, services, and cloud infrastructure.
+Added: To mitigate risk to its systems, endpoints and data, the Company evaluates internal and external threat intelligence, deploys encryption and authentication technologies and other protective measures, maintains security policies and procedures, and conducts awareness training.
+Added: The Company also conducts penetration and vulnerability testing and other risk assessments,
+Added: implements appropriate internal controls, and engages independent third-party auditors to evaluate its compliance with security industry standards.
+Added: The Company’s incident response team, comprised of representatives from the Company’s information technology, information security, product security, engineering, communications, privacy and legal groups, is responsible for addressing actual and potential security threats and other security incidents and implementing the Company’s incident response plan.
+Added: The Company’s incident response plan includes processes and procedures for assessing potential internal and external threats, escalation, activation and notification, crisis management, and post-incident recovery.
+Added: The readiness of the incident response team is promoted through table-top exercises and threat simulations, including during the fiscal year ended February 28, 2025.
+Added: The Company also conducts mandatory training of all employees on its security and data privacy practices and policies and periodically sends simulated phishing emails to employees to build resilience.
In addition, the Company maintains specific policies and practices to mitigate third party security risks, including a process for evaluating the security controls of vendors and service providers who exchange data with the Company or have access to or integrate with the Company’s systems.
−Removed: At the same time, the Company’s control over the security posture of third parties is limited and there can be no assurance that any partner of the Company will not experience a compromise or failure in the information assets under its control.
+Added: At the same time, the Company’s control over the security posture of third parties is limited and there can be no assurance that any vendor or service provider of the Company will not experience a compromise or failure in the information assets under its control.
For the years covered by this report, the Company did not identify any security threats or incidents that have materially affected or are reasonably likely to materially affect its business strategy, results of operations or financial condition.
2 unchanged sentences
Cybersecurity Governance
−Removed: The Board has overall responsibility for the Company’s enterprise risk management program, and the Audit and Risk Management Committee assists the Board with this oversight.
+Added: The Board has overall responsibility for the Company’s enterprise risk management program, including cybersecurity risk, and the Audit and Risk Management Committee assists the Board with this oversight.
The Company’s internal audit function reports to the Audit and Risk Management Committee and, among other things, provides independent assurance on the Company’s risk management activities and internal controls related to cybersecurity risk.
For more information, see Part 3, Item 10 “Directors, Executive Officers and Corporate Governance – Enterprise Risk Management”.
−Removed: Management’s cybersecurity programs operate under the leadership of the Company’s Chief Information Security Officer (“CISO”), who receives reports from his team of information and product security professionals and monitors the prevention, detection, mitigation and remediation of cybersecurity risks.
+Added: Management’s cybersecurity programs operate under the leadership of the Company’s Chief Information Security Officer (“CISO”), who oversees a team of information and product security professionals and monitors the prevention, detection, mitigation and remediation of cybersecurity risks.
The CISO provides quarterly updates to the Board on the advancing maturity of the Company’s cybersecurity program, including reports on security controls coverage and effectiveness, secure software development and product security, vulnerability testing and remediation, and security operations.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.