1 unchanged sentence
Cybersecurity.
−Removed: We use, store and process data for and about our customers, employees, partners and suppliers.
−Removed: We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity thr eats to this data and our systems and business operations, including vetting and managing third-party service providers with comprehensive due diligence, continuous monitoring and strict compliance with industry standards.
−Removed: In addition, we provide cybersecurity awareness training to our employees, incident response personnel, and senior management, including training on best practices for data privacy and security.
−Removed: Our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process.
−Removed: The Board is responsible for overseeing assessments of major risks facing the Company and for reviewing options to mitigate these risks.
−Removed: It has delegated oversight responsibility for information security matters to the Audit Committee, Chief Financial Officer (“CFO”) and our internal information technology (“IT”) resources.
−Removed: Our Director of IT manages our internal team of security professionals, as well as our third-party IT service providers , which provides 24/7 security monitoring.
−Removed: The personnel comprising our IT team include a certified information system security professional and other professionals with many years of experience across a variety of technological sub-specialties.
−Removed: Our CFO oversees our cybersecurity risk management, including appropriate risk mitigation strategies, systems, processes, and controls, and receives updates from IT and our third-party IT service providers on cybersecurity and information security matters.
−Removed: The CFO communicates with the Audit Committee and the Board periodically regarding the state of our cybersecurity risk management, current and evolving threats and recommendations for changes.
−Removed: We have also implemented a cyber incident response plan that provides a protocol to report certain incidents to the CFO with the goal of timely assessment of such incidents, determining applicable disclosure requirements and communicating with the Audit Committee and the Board for timely and accurate reporting of any material cybersecurity incident.
−Removed: The incident response plan is reviewed and tested in the annual cybersecurity desktop exercise.
−Removed: As of the date of this report, we are not aware of any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.
−Removed: For additional discussion of our cybersecurity-related risks, see Part I, Item 1A, “Risk Factors.”
+Added: Risk Management and Strategy
+Added: Cybersecurity risk management is an integral component of Capstone's overall enterprise risk management framework.
+Added: We use, store, and process sensitive data relating to our customers, employees, partners, and suppliers across our business operations, and we recognize that the protection of this data, and the systems through which it flows, is essential to maintaining the trust of our stakeholders and the continuity of our business.
+Added: Following the NIST Cybersecurity Framework, we have implemented a cybersecurity risk management program designed to identify, assess, prioritize, and mitigate risks from cybersecurity threats to our data, systems, and operations.
+Added: Key elements of our program include:
+Added: ● Threat Identification and Continuous Monitoring.
+Added: Our third-party IT service providers provide 24/7 security monitoring of our systems and networks, enabling real-time detection and response to potential threats.
+Added: We supplement this with internal monitoring and periodic assessments designed to identify emerging risks and vulnerabilities before they can be exploited.
+Added: ● Third-Party Risk Management .
+Added: We apply comprehensive due diligence in evaluating and onboarding third-party service providers with access to our systems or data, including assessment of their cybersecurity controls, compliance posture, and incident response capabilities.
+Added: We maintain ongoing monitoring of key third-party relationships and require adherence to applicable security standards as a condition of engagement.
+Added: ● Employee Training and Awareness.
+Added: We provide regular cybersecurity awareness training to all employees, incident response personnel, and senior management, covering best practices for data privacy and security, phishing recognition, and safe handling of sensitive information.
+Added: This training is updated periodically to reflect the evolving threat landscape.
+Added: ● Incident Response Planning.
+Added: We have implemented a formal cyber incident response plan that establishes clear protocols for the identification, escalation, assessment, and remediation of cybersecurity incidents.
+Added: The plan defines reporting obligations to senior management, the Audit Committee, and the Board, with the goal of ensuring timely assessment of material incidents and compliance with applicable disclosure requirements.
+Added: Our incident response plan is reviewed and tested annually through a cybersecurity tabletop exercise to validate its effectiveness and identify areas for improvement.
+Added: ● Integration with Enterprise Risk Management.
+Added: Cybersecurity threats are evaluated alongside other material business risks as part of our broader enterprise risk management process, ensuring that cybersecurity considerations are embedded in strategic and operational decision-making at all levels of the organization.
+Added: The Board is responsible for overseeing the assessment and management of major risks facing the Company, including cybersecurity risks.
+Added: The Board has delegated primary oversight responsibility for information security matters to the Audit Committee , which receives periodic updates from management on the state of the Company's cybersecurity program, current and emerging threats, and the effectiveness of risk mitigation strategies and controls.
+Added: At the management level, our Chief Financial Officer ("CFO") has overall responsibility for cybersecurity risk management oversight, including the adequacy of risk mitigation strategies, systems, processes, and controls.
+Added: The CFO receives regular updates from our internal IT team and third-party service providers on cybersecurity and information security matters, and communicates with the Audit Committee and the Board on a periodic basis , and promptly in the event of a significant incident, regarding the state of our cybersecurity posture and any material developments.
+Added: Day-to-day cybersecurity operations are managed by our Director of IT, who leads an internal team of security professionals and coordinates with our third-party IT service providers.
+Added: Our IT team includes a Certified Information Systems Security Professional ("CISSP") and other professionals with extensive experience across a range of cybersecurity and technology disciplines.
+Added: This combination of internal expertise and external 24/7 monitoring support is designed to provide comprehensive coverage of our cybersecurity risk environment.
+Added: The Audit Committee reviews cybersecurity risk as part of its broader risk oversight responsibilities and maintains direct lines of communication with both the CFO and the Director of IT to ensure that material developments are escalated appropriately and that the Board maintains informed oversight of this critical risk area.
+Added: Cybersecurity Incidents
+Added: As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.
+Added: However, cybersecurity threats are continuously evolving, and we cannot provide assurance that our program will prevent all incidents or that future incidents will not have a material impact on our business.
+Added: For a more complete discussion of cybersecurity-related risks, see Part I, Item 1A, “Risk Factors.”
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.