4 unchanged sentences
A critical part of our strategy involves focusing on gathering data without collecting, maintaining or using sensitive personal data such as social security numbers, credit card numbers, financial account information or medical records.
−Removed: The Cardlytics platform is designed so that we do not receive or have access to any PII from our FI partners.
+Added: The Cardlytics platform is designed so that we do not receive or have access to any personal data from our FI partners.
We only perform targeted marketing using data that has undergone processing such that it is only linked to anonymized identifiers.
1 unchanged sentence
Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity and availability of our information assets and mitigate harm to our business.
−Removed: Risks from cybersecurity threats are among those that we address in our general risk management program, where we conduct investigations and take actions as required to assess risks to the organization and take mitigating actions to reduce, eliminate or manage risks.
+Added: Risks from cybersecurity threats are among those that we address in our general risk management program, where we conduct investigations and take actions as required to assess risks to the organization and take mitigating actions designed to reduce, eliminate or manage risks.
Risk assessments are performed quarterly as part of this program and the results are discussed and reviewed with management.
−Removed: We identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry’s risk profile, evaluating threats reported to us, logging and monitoring our IT environment, conducting threat assessments for internal and external threats and conducting vulnerability assessments to identify vulnerabilities.
+Added: We identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating threats reported to us, logging and monitoring our IT environment, conducting threat assessments for internal and external threats, conducting vulnerability assessments to identify vulnerabilities and conducting tabletop incident response exercises.
We rely on a multidisciplinary team (including from our information security function, management, and third-party service providers) to assess how cybersecurity threats could impact our business.
1 unchanged sentence
Based on our assessment process, we implement and maintain various technical, physical and organizational measures designed to manage and mitigate such risks and potential material impacts.
−Removed: We may implement measures designed to prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.
+Added: We implement measures designed to prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.
We prioritize our efforts based on the threats that are more likely to lead to a material impact to our business, such as ransomware, theft of IP and interruption of services.
20 unchanged sentences
We work with third parties from time to time that assist us to identify, assess and manage cybersecurity risks, including professional services firms to conduct SOC 2, Type II assessments, incident response consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms and other vendors that help to identify, assess, or manage cybersecurity risks.
−Removed: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as professional services, SaaS platforms, managed services, cloud-based infrastructure, data center facilities, encryption and authentication technology and other functions.
−Removed: Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide or the information they process, conducting security assessments, conducting on-site inspections, requiring their completion of written
−Removed: questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.
+Added: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as professional services, SaaS platforms, managed services, cloud-based infrastructure, encryption and authentication technology and other functions.
+Added: Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide or the information they process, conducting security assessments, requiring their completion of written questionnaires regarding their services and data handling practices and conducting periodic re-assessments during their engagement.
For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, refer to our risk factors under Part 1.
−Removed: "Risk Factors" in this Annual Report, including "An actual or perceived breach of the security of our systems, or those of third parties upon which we rely, could result in adverse consequences resulting from such breach, including but not limited to a disruption of our operations, reputational harm, loss of revenue or profits, loss of customers, regulatory investigations or actions, litigation, fines and penalties and other adverse consequences."
+Added: "Risk Factors" in this Annual Report , including "An actual or perceived breach of the security of our systems, or those of third parties with whom we work, could result in adverse consequences resulting from such breach, including but not limited to a disruption of our operations, reputational harm, loss of revenue or profits, loss of customers, regulatory investigations or actions, litigation, fines and penalties and other adverse consequences."
Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function.
The board of directors along with the audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.
−Removed: Our cybersecurity risk management strategy relies on input from management, including the Chief Technology Officer, Chief Legal and Privacy Officer, Chief Operating Officer, and Chief Financial Officer, who report to the Chief Executive Officer, as well as the Chief Information Security Officer, to help us understand cybersecurity risks, establish priorities, determine the scope and details of our cybersecurity program and implement it.
+Added: Our cybersecurity risk management strategy relies on input from management, including the Chief Technology Officer, Chief Legal and Privacy Officer, and Chief Financial Officer, who report to the Chief Executive Officer, as well as the Chief Information Security Officer , to help us understand cybersecurity risks, establish priorities, determine the scope and details of our cybersecurity program and implement it.
Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees.
−Removed: Our cybersecurity incident response and vulnerability management processes involve management, who participates in our disclosure controls and procedures.
+Added: Our cybersecurity incident response and vulnerability management processes involve management, who participate in our disclosure controls and procedures.
Every six months, management discusses cybersecurity risk and reviews our cybersecurity program.
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.