18 unchanged sentences
We maintain a risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems.
+Added: We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes.
+Added: These third parties include cybersecurity assessors, consultants and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks.
• Education and Awareness:
−Removed: We provide regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, as well as to communicate our evolving information security policies, standards, processes, and practices.
−Removed: We conduct periodic assessments and testing of our policies, standards, processes, and practices in a manner designed to address cybersecurity threats and events.
−Removed: The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit and Finance Committee of the Board, or the Audit and Finance Committee, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.
+Added: We provide quarterly, regular, mandatory training for all employees regarding cybersecurity threats as a means to equip our employees with tools to make employees aware of and to address cybersecurity threats, as well as to communicate our evolving information security policies, standards, processes, and practices.
+Added: We conduct quarterly assessments and testing of our policies, standards, processes, and practices in a manner designed to address cybersecurity threats and events.
+Added: The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit and Finance Committee of the Board, or the Audit and Finance Committee, on a quarterly basis, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.
The Board, in coordination with the Audit and Finance Committee, oversees our risk management program, including the management of cybersecurity threats.
The Board and the Audit and Finance Committee each receive regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties.
−Removed: The Board and the Audit and Finance Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds.
+Added: The Board and the Audit and Finance Committee also
+Added: receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds.
Annually, the Board and the Audit and Finance Committee discuss our approach to overseeing cybersecurity threats with our Chief Technology Officer, or CTO, and other senior management members.
7 unchanged sentences
Material Effects of Cybersecurity Incidents
−Removed: Except as described in the section entitled “Risk Factors” included in Part I, Item 1A, including, without limitation, the risk factor above titled “ We face four primary risks relative to protecting critical information:
−Removed: loss of access risk, inappropriate disclosure risk, inappropriate modification risk and the risk of our being unable to identify and audit our controls over the first three risks.
−Removed: In addition, an application, data security or network incident may allow unauthorized access to our systems or data or our customers’ data, disable access to our service, harm our reputation, create additional liability and adversely impact our financial results ” risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.
+Added: Except as described in the section entitled “Risk Factors” included in Part I, Item 1A, including, without limitation, the risk factor above titled “ Security breaches, loss of data, or other disruptions could compromise sensitive information prevent access to critical information, expose us to liability, and adversely affect our business and our reputation ” risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition.
In this instance, materiality is defined as an adverse impact to our critical information, which could result in significant legal and financial exposure.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.