21 unchanged sentences
Information Security Policy and Requirements
−Removed: The Company’s Information Security Policy (“Policy”) is based upon the International Organization for Standardization (“ISO”) 27001, Health Information Trust Alliance (“HITRUST”) Common Security Framework (“CSF”), System and Organization Controls 2 Type 2 (“SOC 2 Type 2”), and Payment Card Industry Data Security Standard (“PCI DSS”) frameworks and standards and provides specific and detailed direction and support for appropriately maintaining the overall security, confidentiality, integrity, and availability of information within the Company.
+Added: The Company’s Information Security Policy (“Policy”) is based upon the International Organization for Standardization (“ISO”) 27001, HITRUST Common Security Framework (“CSF”), System and Organization Controls 2 Type 2
+Added: (“SOC 2 Type 2”), FedRAMP, and Payment Card Industry Data Security Standard (“PCI DSS”) frameworks and standards and provides specific and detailed direction and support for appropriately maintaining the overall security, confidentiality, integrity, and availability of information within the Company.
The Policy covers all processes, equipment, hardware, and software owned or under the control of the Company as well as networks operated by third parties containing Company information or processes.
1 unchanged sentence
The Policy applies to all employees, consultants, contractors, and other such persons (“Personnel”) with access to the aforementioned processes, equipment, hardware, and software.
−Removed: The Policy requires that Personnel agree to and are
−Removed: trained annually on all components of the Policy as a condition of employment, partnership, or temporary affiliation with the Company.
+Added: The Policy requires that Personnel agree to and are trained annually on all components of the Policy as a condition of employment, partnership, or temporary affiliation with the Company.
Employee Trainings
−Removed: All Company employees must complete trainings at least annually on various security threats and best practices including, but not limited to, trainings on the following topics:
+Added: All Company employees are required to complete trainings at least annually on various security threats and best practices including, but not limited to, trainings on the following topics:
the Company’s Information Security Policy;
17 unchanged sentences
In addition to our internal cybersecurity capabilities, we regularly engage with consultants, and other third parties to assist with assessing, identifying, and managing cybersecurity risks.
−Removed: Specifically, the Company is engaged with third-party auditors for HITRUST, PCI, and SOC 2 Type 2 for annual certification.
+Added: Specifically, the Company is engaged with third-party auditors for HITRUST, PCI, ISO 27001, FedRamp (High Impact), and SOC 2 Type 2 for annual certification.
We are also engaged with a third-party Data Protection Officer to oversee compliance with the GDPR.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.