12 unchanged sentences
In addition, we maintain insurance that includes cybersecurity coverage.
−Removed: Areas of cybersecurity risk are assessed bi-annually, and updates are reported by our Vice President of Information Technology (“VP IT”) to the Board’s Audit Committee and senior management annually.
+Added: Areas of cybersecurity risk are assessed bi-annually, and updates are reported by our Chief Financial Officer to the Board’s Audit Committee and senior management annually.
Where our bi-annual cybersecurity risk assessment identifies areas for improvement, we document and track our remediation activities, which are also reported to the Audit Committee and senior management annually.
In this way, our program to manage cybersecurity risk integrates with our overall risk management processes.
−Removed: With respect to third parties who provide services affecting critical business management systems, we collect and maintain SOC2 type II reports (attestation of controls at a service organization over a minimum six-month period).
+Added: With respect to third parties who provide services affecting critical business management systems, we collect and maintain SOC2 or SOC1 type II reports (attestation of controls at a service organization over a minimum six-month period).
For other third-party service providers, cybersecurity risk is addressed as appropriate.
6 unchanged sentences
The Audit Committee has oversight of the Company’s cybersecurity risk management programs and the design and operating effectiveness thereof, and reviews reports from Company management on cybersecurity, data privacy and other risks relevant to the Company’s computerized information system controls and security.
−Removed: Areas of cybersecurity risk are assessed bi-annually, and updates are reported by the VP IT to the Audit Committee and senior management annually.
+Added: Areas of cybersecurity risk are assessed bi-annually, and updates are reported by the Chief Financial Officer to the Audit Committee and senior management annually.
Where our bi-annual cybersecurity risk assessment identifies areas for improvement, we document and track our remediation activities, which are also reported to the Audit Committee and senior management annually.
1 unchanged sentence
The Cybersecurity Council is made up of representatives of IT, Legal and Finance, as well as ad hoc additional members depending on the circumstances of the incident or threat.
−Removed: The members of the Cybersecurity Council do not have specific expertise in cybersecurity risk other than the VP IT who has more than 20 years of experience, and engages with trusted third-party experts for support and guidance when additional expertise is required.
−Removed: Prior to joining Codexis, our VP IT has managed cybersecurity functions, where he was responsible for overseeing cybersecurity strategy and operations, including incident response, threat intelligence, security awareness training programs, risk assessments and remediation, and regulatory and compliance matters.
+Added: The members of the Cybersecurity Council do not have specific expertise in cybersecurity risk other than the Vice President of Information Technology (“VP IT”) who has more than 20 years of experience, and engages with trusted third-party experts for support and guidance when additional expertise is required.
+Added: In December 2024, the VP IT exited the company, and IT expert advice to the Cybersecurity Council is currently provided by an external cybersecurity specialist.
+Added: This specialist has extensive experience managing cybersecurity functions in his prior external roles, where he was responsible for overseeing cybersecurity strategy and operations, including incident response, threat intelligence, security awareness training programs, risk assessments and remediation, and regulatory and compliance matters.
An actual or suspected cybersecurity incident that jeopardizes the confidentiality, integrity, or availability of Codexis' information systems or any information residing therein (or threat that presents significant risk to our information systems as identified by IT) is reported to the Cybersecurity Council by our IT Department.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.