8 unchanged sentences
Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity and availability of our information assets and mitigate harm to our business.
−Removed: Risks from cybersecurity threats are among those that we address in our general risk management program, where we conduct investigations and take actions as required to assess risks to the organization and take mitigating actions designed to reduce, eliminate or manage risks.
+Added: Risks from cybersecurity threats are among those that we address in our enterprise risk management program, where we conduct investigations and take actions as required to assess risks to the organization and take mitigating actions designed to reduce, eliminate or manage risks.
Risk assessments are performed quarterly as part of this program and the results are discussed and reviewed with management.
−Removed: We identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating threats reported to us, logging and monitoring our IT environment, conducting threat assessments for internal and external threats, conducting vulnerability assessments to identify vulnerabilities and conducting tabletop incident response exercises.
+Added: We maintain measures designed to identify such threats by, among other things, monitoring the threat environment using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating threats reported to us, logging and monitoring our IT environment, conducting threat assessments for internal and external threats, conducting vulnerability assessments to identify vulnerabilities and conducting tabletop incident response exercises.
We rely on a multidisciplinary team (including from our information security function, management, and third-party service providers) to assess how cybersecurity threats could impact our business.
23 unchanged sentences
and a dedicated cybersecurity staff and officer.
+Added: Cardlytics’ information security control environment is designed to align with elements of the NIST Cybersecurity Framework (CSF) or other industry standards.
+Added: Our controls are structured around the NIST core functions (Govern, Identify, Protect, Detect, Respond, and Recover) and are periodically reviewed to ensure they remain appropriate to the nature, scale, and complexity of our operations and risk profile.
We work with third parties from time to time that assist us to identify, assess and manage cybersecurity risks, including professional services firms to conduct SOC 2, Type II assessments, incident response consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms and other vendors that help to identify, assess, or manage cybersecurity risks.
6 unchanged sentences
Our cybersecurity risk management strategy relies on input from management, including the Chief Technology Officer, Chief Legal and Privacy Officer, and Chief Financial Officer, who report to the Chief Executive Officer, as well as the Chief Information Security Officer , to help us understand cybersecurity risks, establish priorities, determine the scope and details of our cybersecurity program and implement it.
+Added: The Chief Technology Officer and Chief Information Security Officer in particular have decades of experience assessing and managing cybersecurity risk at various organizations with differentiated risk profiles.
Management is also responsible for hiring appropriate personnel, integrating cybersecurity considerations into our overall risk management strategy, and for communicating key priorities to employees.
Our cybersecurity incident response and vulnerability management processes involve management, who participate in our disclosure controls and procedures.
−Removed: Every six months, management discusses cybersecurity risk and reviews our cybersecurity program.
−Removed: Management is also responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports, and reporting to the board of directors regarding cybersecurity matters.
+Added: On a regular basis, management discusses cybersecurity risk and reviews our cybersecurity program.
+Added: Management is responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports, and reporting to the board of directors regarding cybersecurity matters.
Management is involved with our efforts to prevent, detect, and mitigate cybersecurity incidents by overseeing and testing of incident response plans.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.