7 unchanged sentences
See Note 11 to the consolidated audited financial statements contained in this report for additional information regarding the Security Incident.
+Added: 2025 Form 10-K
+Added: Blackbaud, Inc.
We utilize a four-prong strategy for assessing, identifying and managing material risks from cybersecurity threats:
11 unchanged sentences
In addition, Blackbaud employees are all engaged in on-going security and privacy awareness training campaigns to ensure they are empowered to protect both Blackbaud’s and our customers’ data.
−Removed: 2024 Form 10-K
−Removed: Blackbaud, Inc.
Integration into Overall Risk Management System or Processes
12 unchanged sentences
In addition, we continuously learn from and leverage experience gained from previous cybersecurity incidents that we, like many other companies, have experienced.
−Removed: As previously disclosed, we have been and remain subject to risks and uncertainties as a result of a ransomware attack against us in May 2020 in which a cybercriminal removed a copy of a subset of data from our self-hosted environment.
−Removed: As a result of the Security Incident, we are currently subject to certain legal proceedings and claims and could be the subject of additional legal proceedings, claims, inquiries and investigations in the future that might result in adverse judgments, settlements, fines, penalties or other resolution.
−Removed: See Note 11 to the consolidated audited financial statements contained in this report for additional information regarding the Security Incident and its past and potential impact on the Company.
+Added: As previously disclosed, we were subject to a ransomware attack against us in May 2020 in which a cybercriminal removed a copy of a subset of data from our self-hosted environment.
+Added: As a result of the Security Incident, we were subject to various legal proceedings, claims, inquiries and investigations, the resolution of which resulted in material adverse judgments, settlements, fines, penalties or other resolutions.
+Added: See Note 11 to the consolidated audited financial statements contained in this report for additional information regarding the Security Incident and its impact on the Company.
+Added: 2025 Form 10-K
+Added: Blackbaud, Inc.
Notwithstanding our strong commitment to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.
1 unchanged sentence
Management's Assessment and Management of Cybersecurity Threats
−Removed: Our multi-level cybersecurity governance and risk management structure begins with our Operational Risk Compliance and Security (“ORCAS”) Committee consisting of cross-functional management representatives throughout our Company.
−Removed: The ORCAS Committee receives detailed cybersecurity information from key security personnel and reports at least quarterly up through our Risk Steering Committee, which is made up of executives and senior management from various Blackbaud departments:
−Removed: Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, Chief Technology Officer, General Counsel, Chief Privacy Officer and CISO, who has extensive information technology and program management experience.
−Removed: Our CISO has served in various roles of increasing responsibility in information technology and information security for more than 25 years, including serving in various cybersecurity leadership roles within public and private companies.
−Removed: He holds two undergraduate degrees—one in business administration and the other in computer information systems, a graduate degree in information systems and maintains two cybersecurity industry recognized certifications:
−Removed: Certified Information Systems Security Professional (CISSP) and Certified Cloud Security Professional (CCSP), both from the International Information System Security Certification Consortium.
+Added: Our multi-level cybersecurity governance and risk management structure begins with our Risk Evaluation & Enterprise Framework ("REEF") Committee consisting of cross-functional management representatives throughout our Company.
+Added: The REEF Committee receives detailed cybersecurity information from key security personnel and reports at least quarterly up through our Risk Steering Committee, which is made up of executives and senior management from various Blackbaud departments:
+Added: Chief Executive Officer, Chief Operating Officer, Chief Financial Officer, Chief Information Officer, Chief Technology Officer, Chief Legal Officer, Chief Privacy Officer and CISO, who has extensive information technology and program management experience.
+Added: Our CISO has served in various roles of increasing responsibility in information technology and information security for more than 25 years, including serving in various cybersecurity leadership roles at private companies.
+Added: He holds two undergraduate degrees—one in business administration and the other in computer information systems—and a graduate degree in information systems, maintains multiple cybersecurity industry recognized certifications and is an alumnus of the FBI CISO Academy.
Cybersecurity leaders reporting to our CISO also have significant information technology and information security experience and industry recognized certifications.
−Removed: 2024 Form 10-K
−Removed: Blackbaud, Inc.
Additionally, our cybersecurity Incident Response plan timely informs our Cybersecurity Incident Subcommittee on active cybersecurity incidents that are potentially material.
−Removed: The Cybersecurity Subcommittee determines cybersecurity materiality and is made up of our General Counsel, CISO, Chief Accounting Officer and Director of SEC Reporting.
+Added: The Cybersecurity Subcommittee determines cybersecurity materiality and is made up of our Chief Legal Officer, CISO and Senior Director of SEC Reporting.
Our Cybersecurity Incident Subcommittee is part of our Disclosure Committee, which is appointed by Chief Executive Officer and Chief Financial Officer to assist our executives in their responsibility for oversight of the accuracy and timeliness of the disclosures made by Blackbaud.
3 unchanged sentences
The Risk Oversight Committee communicates as appropriate with the full Board of Directors, which is ultimately responsible for cybersecurity risk oversight.
+Added: 2025 Form 10-K
+Added: Blackbaud, Inc.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.