3 unchanged sentences
Cybersecurity Risk Management and Strategy
−Removed: The Company has developed and implemented a Cybersecurity and Information Technology Incident Response Plan intended to ensure the confidentiality, integrity, and availability of the Company’s critical systems and information.
−Removed: The Company has designed this Cybersecurity and Information Technology Incident Response Plan based in part on the National Institute of Standards and Technology Cybersecurity Framework (“NIST”).
+Added: The Company has developed and implemented a Cybersecurity program intended to ensure the confidentiality, integrity, and availability of the Company’s critical systems and information.
+Added: The Company has designed this Cybersecurity program based in part on the National Institute of Standards and Technology Cybersecurity Framework (“NIST”).
Use of the framework does not imply that the Company meets any particular technical standards, specifications, or requirements, but rather the NIST is used as a guide to help identify, assess, and manage cybersecurity risks relevant to the Company’s business.
−Removed: The Company’s Cybersecurity and Information Technology Response Plan is led by our Chief Operations Officer, (“COO”) who is responsible for the oversight and implementation of such plan.
+Added: The Company’s Cybersecurity and Information Technology programs are led by our Chief Operations Officer, (“COO”) and Information Security Manger.
+Added: The COO is responsible for the oversight and implementation of both programs.
Additionally, the COO and the Information Security Manager meet with the Information Technology Steering Committee (“IT Steering Committee”) on a monthly basis or more frequently as necessary to discuss, among other things, cybersecurity matters.
−Removed: The Cybersecurity and Information Technology Incident Response Plan is aligned to the Company’s business strategy.
−Removed: It shares common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk management, including legal, compliance, strategic, operational, and financial risk.
+Added: The Cybersecurity and Information Technology programs are aligned to the Company’s business strategy.
+Added: They share common methodologies, reporting channels and governance processes that apply to other areas of enterprise risk management, including legal, compliance, strategic, operational, and financial risk.
In the event of a material or potentially material cybersecurity event, senior members of management, which includes the Chief Financial Officer, are promptly informed of the event and status update, response, and disclosure efforts following the terms of a documented incident response plan.
−Removed: Key elements of the Cybersecurity and Information Technology Incident Response Plan include:
+Added: Key elements of the Cybersecurity and Information Technology programs include:
• risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader information technology (“IT”) environment;
4 unchanged sentences
• utilization of independent third parties to perform penetration testing of the Company’s environment;
−Removed: • utilization of a third party to monitor our environment continuously.
−Removed: The Company has experienced cybersecurity incidents in the past, but none of these incidents, individually or in the aggregate, have had a material adverse effect on our business, financial condition or results of operations.
+Added: • utilization of a third party to monitor elements of our Cybersecurity and IT environment continuously.
+Added: During the years ended December 31, 2024 and December 31, 2023, the Company had no cybersecurity incidents that had a material adverse effects on its business, financial condition or results of operations.
For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, refer to Item 1A.
14 unchanged sentences
The COO escalates incidents to the Company’s IT Steering Committee, who is responsible for cybersecurity risk oversight, and also reports to the Board on a monthly basis.
−Removed: Our information security team and members of IT also monitor the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with law enforcement, regulators, and external consultants we may engage, and reports produced by security tools we have deployed in our IT environment.
+Added: Our information security team and members of IT monitor the effectiveness of preventative measures, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with law enforcement, regulators, external consultants, and reports produced by security tools we have deployed in our IT environment.
Board of Director’s Role
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.