3 unchanged sentences
Candel has implemented cybersecurity risk management processes that are informed by industry standards in accordance with the scale of our business.
+Added: Our quality assurance organization has implemented a risk management program for our company at large, and our IT team is responsible for ensuring alignment between our overall risk management processes and our cybersecurity risk management processes.
Our cybersecurity risk management processes are designed to assess, identify and mitigate risks from current and emerging cybersecurity threats.
4 unchanged sentences
Our process for onboarding new vendors with access to critical systems or data includes vendor questionnaires, contractual obligations, and if deemed appropriate, review of vendor audit reports.
−Removed: Our incident management processes include reporting to senior management, including the Chief Financial Officer (CFO), Chief Executive Officer, Vice President Quality Assurance, and Director GxP Systems, and, where appropriate, to the board of directors.
+Added: Our incident management processes include reporting to senior management, including the Chief Financial Officer (CFO), Chief Executive Officer, Senior Vice President Quality Assurance and, where appropriate, to the board of directors.
To date, we have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
3 unchanged sentences
The board of directors has delegated oversight of the Company’s cybersecurity risk management program to the Audit Committee, including responsibilities for reviewing and discussing cybersecurity risks, implementing risk management programs, controls and procedures, and performing high level reviews of the threat landscape.
−Removed: Our Senior Director, Information Technology (Senior Director, IT) is responsible for the strategic leadership and day-to-day management of our cybersecurity risk management program.
+Added: Our Vice President, Information Technology (VP, IT) is responsible for the strategic leadership and day-to-day management of our cybersecurity risk management program.
The individual occupying this role has over thirty years of experience with information technology management and over five years of cybersecurity risk management.
−Removed: Our Senior Director, IT engages in regular meetings with our third-party managed IT service provider and the Director, IT to review and assess our cybersecurity risk management processes.
−Removed: The Senior Director, IT reports such findings to our CFO who annually presents updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities to our Audit Committee.
+Added: Our VP, IT engages in regular meetings with our third-party managed IT service provider and the Director, IT Infrastructure and Operations to review and assess our cybersecurity risk management processes.
+Added: The VP, IT reports such findings to our CFO who annually presents updates on cybersecurity risks, mitigation strategies, and, if necessary, incident response activities to our Audit Committee.
Further, our Audit Committee updates the full board of directors on matters relating to cybersecurity risk management, as necessary .
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.