4 unchanged sentences
Board of Directors
−Removed: Our Board, in coordination with the Audit Committee, oversees the Company’s enterprise risk management process, including the management of risks arising from cybersecurity threats.
−Removed: Our Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee.
+Added: Our Board of Directors , in coordination with the Audit Committee of the Board of Directors (the “Audit Committee”), oversees the Company’s enterprise risk management process, including the management of risks arising from cybersecurity threats.
+Added: Our Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee.
The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.
As part of such reviews, the Audit Committee receives presentations at least quarterly from members of our team responsible for overseeing the Company’s cybersecurity risk management, including the Chief Information Security Officer (“CISO”), Chief Technology Officer (“CTO”), Chief Legal Officer (“CLO”), and Head of Internal Audit, which address topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company’s peers and third parties.
−Removed: Then, the Audit Committee and such members of our management team report to the Board on a quarterly basis, with an in-depth review at least annually, on data protection and cybersecurity matters.
−Removed: Additionally, the Company has protocols for cybersecurity incidents that meet established reporting thresholds for escalation within the Company including, where appropriate, reporting to the Board and Audit Committee, with required updates for ongoing matters until any such incident has been addressed and resolved.
+Added: Then, the Audit Committee and such members of our management team report to the Board of Directors on a quarterly basis, with an in-depth review at least annually, on data protection and cybersecurity matters.
+Added: Additionally, the Company has protocols for cybersecurity incidents that meet established reporting thresholds for escalation within the Company including, where appropriate, reporting to the Board of Directors and Audit Committee, with required updates for ongoing matters until any such incident has been addressed and resolved.
The Company has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.
−Removed: At the management level, our Cybersecurity and Governance Council, composed of the CISO, CTO, CLO, Chief Revenue Officer and EVP of Operations, and Head of Internal Audit has broad oversight of the Company’s risk management processes.
+Added: At the management level, our Cybersecurity and Governance Council, composed of the CISO, CTO, CLO, Chief Revenue Officer and Executive Vice President of Operations, and Head of Internal Audit has broad oversight of the Company’s risk management processes.
The Cybersecurity and Governance Council meets regularly to discuss the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.
7 unchanged sentences
Information Security Policy and Requirements
−Removed: The Company’s Information Security Policy (“Policy”) is based upon the ISO 27001, HITRUST CSF, SOC 2 Type 2, and PCI DSS frameworks and standards and provides specific and detailed direction and support for appropriately maintaining the overall security, confidentiality, integrity, and availability of information within the Company.
+Added: The Company’s Information Security Policy (“Policy”) is based upon the International Organization for Standardization (“ISO”) 27001, Health Information Trust Alliance (“HITRUST”) Common Security Framework (“CSF”), System and Organization Controls 2 Type 2 (“SOC 2 Type 2”), and Payment Card Industry Data Security Standard (“PCI DSS”) frameworks and standards and provides specific and detailed direction and support for appropriately maintaining the overall security, confidentiality, integrity, and availability of information within the Company.
The Policy covers all processes, equipment, hardware, and software owned or under the control of the Company as well as networks operated by third parties containing Company information or processes.
1 unchanged sentence
The Policy applies to all employees, consultants, contractors, and other such persons (“Personnel”) with access to the aforementioned processes, equipment, hardware, and software.
−Removed: The Policy requires that Personnel agree to and are trained annually on all components of the Policy as a condition of employment, partnership, or temporary affiliation with the Company.
+Added: The Policy requires that Personnel agree to and are
+Added: trained annually on all components of the Policy as a condition of employment, partnership, or temporary affiliation with the Company.
Employee Trainings
3 unchanged sentences
HIPAA, PCI Compliance;
−Removed: GDPR and CCPA;
+Added: General Data Protection Regulation (“GDPR”) and CCPA;
Security Awareness and Incident Response Training covering Social Engineering Phishing (identification and common red flags), Social Media safety best practices, Internet Security best practices, and Incident response training for end-users;
and Phishing.
−Removed: In addition, our developers must complete Secure Code / Secure Application Development Training based on OWASP top 10 standards.
+Added: In addition, our developers must complete Secure Code / Secure Application Development Training based on Open Web Application Security Project top 10 standards.
Incident Response
1 unchanged sentence
The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate.
−Removed: In general, our incident response process follows the NIST framework and focuses on four phases:
+Added: In general, our incident response process follows the National Institute of Standards and Technology (“NIST”) framework and focuses on four phases:
detection and analysis;
7 unchanged sentences
Specifically, the Company is engaged with third-party auditors for HITRUST, PCI, and SOC 2 Type 2 for annual certification.
−Removed: We are also engaged with a third party Data Protection Officer to oversee compliance with the General Data Protection Regulation (GDPR).
+Added: We are also engaged with a third-party Data Protection Officer to oversee compliance with the GDPR.
Material Cybersecurity Risks, Threats & Incidents
−Removed: While we have not experienced any risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents.
+Added: While we have not experienced any risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that, to our knowledge, have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents.
We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary and other types of information.
−Removed: Despite ongoing efforts to continue improvement of our and our vendors’ ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory
−Removed: penalties, among other consequences.
+Added: Despite ongoing efforts to continue improvement of our and our vendors’ ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences.
Additional information on cybersecurity risks we face can be found in Part I, Item 1A “Risk Factors” of this Form 10-K under the heading “Risks Related to our Business,” which should be read in conjunction with the foregoing information.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.