1 unchanged sentence
Cybersecurity.
−Removed: We are committed to safeguarding our customers and the sensitive information shared in the application of software and services provided.
−Removed: Our cybersecurity program, risk management and governance reflect our dedication to not only meeting industry standards but exceeding them.
+Added: We are committed to safeguarding our customers’ information that is shared with us in the application of the software and services we contractually provide to them.
+Added: Our information systems, including our cybersecurity program, risk management systems and processes and governance, reflect our dedication to meeting industry cybersecurity standards.
Risk Management and Strategy
−Removed: We recognize that cybersecurity risks pose a significant threat to our business, customers, and stakeholders, and we have implemented a comprehensive security and privacy program to address these risks.
−Removed: We embed security considerations into every aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to emerging threats to ensure that our customers' information remains secure in the face of evolving cybersecurity challenges.
−Removed: With a foundation grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 20, OWASP Top 10, and Security by
−Removed: T able of Contents
−Removed: Design, we prioritize the identification and assessment of risks to create a protective shield around our customers' data.
−Removed: This foundation guides our processes for assessing, identifying, and managing risks related to cybersecurity threats and incidents, as well as ensuring compliance with legal and contractual obligations.
−Removed: Our risk management processes are integrated into our overall business strategy and operations.
−Removed: We use various methods and tools to identify and assess cybersecurity risks across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, and audits from customers.
−Removed: We also use third-party assessors and service providers, consultants, and auditors, to support our risk management processes and to provide independent validation and verification of our security posture.
−Removed: We have established processes to oversee and identify risks associated with our use of third-party assessors and service providers, such as due diligence, contractual obligations, monitoring and vendor evaluation and qualification.
−Removed: We maintain robust cybersecurity incident response procedures, which includes escalating incidents to the appropriate level of management, mitigation, remediation and the assessment of materiality of cybersecurity incidents, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.
−Removed: We also disclose information regarding our security and privacy program and practices on our website and in our public-facing notices.
+Added: We have implemented a comprehensive cybersecurity and data privacy program as part of our risk management processes to assess, identify and manage risks posed to our business by cybersecurity threats.
+Added: We embed cybersecurity considerations into every material aspect of our operations, and our focus encompasses a proactive approach that involves continuous monitoring to swiftly detect and respond to cybersecurity threats.
+Added: Our cybersecurity risk management processes are grounded in industry best practices, including NIST 800-53, ISO 27001, CIS Top 18, OWASP Top 10, and Security by Design and are intended to prevent adverse effects on the confidentiality, integrity and availability of our information systems and information residing therein.
+Added: Our cybersecurity processes have been integrated into our risk management processes in order for us to assess, identify, and manage risks related to cybersecurity threats and ensure compliance with our legal and contractual obligations, which require us to safeguard the confidential and sensitive information provided to us by our customers.
+Added: For example, we use various methods and tools to identify and assess cybersecurity threats across all assets in our technical landscape, such as vulnerability scanning, penetration testing, threat intelligence, risk assessments, and audits from customers.
+Added: We regularly engage third-party assessors, service providers, consultants, and auditors to support and review our risk management processes and to provide independent validation and verification of our security posture.
+Added: We have established processes to oversee and identify risks from cybersecurity threats associated with our use of third-party assessors and service providers , such as due diligence, contractual language, monitoring and periodic vendor evaluation and qualification.
+Added: We maintain robust cybersecurity threat procedures, which includes escalating threats to the appropriate level of risk management, mitigation, remediation and the assessment of materiality of cybersecurity threats, or a series of related incidents, that may materially affect or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.
+Added: We disclose information regarding our cybersecurity and privacy program and practices on our website and in our public-facing notices.
Furthermore, we conduct annual cybersecurity awareness training for our employees in order to provide them with the knowledge necessary to navigate the digital landscape securely.
We understand that cybersecurity is not a static concept but a dynamic discipline, and our security and privacy program reflects this by incorporating internal and third-party audits, penetration testing, active vulnerability scanning and a continuous improvement mindset.
−Removed: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents, or a series of related incidents, that have had or are reasonably likely to have a material impact on the Company’s business strategy, results of operations or financial condition.
−Removed: For more information on our cybersecurity related risks, see Part 1, Item 1A.
+Added: As of December 31, 2024, we were not aware of any cybersecurity threats that have materially affected, or are reasonably likely to affect, the Company, including its business strategy, results of operations or financial condition.
+Added: As discussed more fully under Part 1, Item 1A.
+Added: Risk Factors, the sophistication of cyber threats continues to increase, and the preventative actions the Company takes to reduce the risk of cyber incidents and protect its systems and information may be insufficient.
+Added: No matter how well designed or implemented the Company’s cybersecurity controls are, it will not be able to anticipate all security breaches, and it may not be able to implement effective preventive measures against cybersecurity breaches in a timely manner.
Risk Factors entitled “Risks Related to Intellectual Property, Information Technology and Data Privacy” included elsewhere in this Annual Report on Form 10-K.
−Removed: We have established a corporate governance structure that provides oversight and guidance for our security and privacy program.
−Removed: The Board of Directors (the “Board”) is ultimately responsible for the oversight of the Company’s security and privacy program.
−Removed: The Audit Committee, which supports the Board in the oversight of the program, is focused on cybersecurity and data privacy risk, including incident response planning, timely identification and assessment of incidents, incident recovery and business continuity considerations.
−Removed: We have defined roles and responsibilities for the management of cybersecurity risks, including specific executive-level and management-level positions or committees.
−Removed: Our security and privacy program is overseen by our Security and Privacy Program Office (“SPPO”), which is composed of corporate leadership from legal and IT.
−Removed: The SPPO is accountable to the VP of Information Technology, who is the accountable executive for the program.
−Removed: Our function and business unit executive leadership, acting in support of the SPPO and the Board, is responsible for ensuring organizational compliance with data protection regulations and controls across the organization.
−Removed: Our VP of Information Technology and Director, Compliance Standards & Data Privacy ("DCSDP"), are responsible for the design, implementation, and monitoring of the security and privacy policies, standards, procedures, and controls that govern our information systems and data processing activities.
−Removed: Our VP of Information Technology, has 30 years of experience in IT infrastructure, cybersecurity operations, and site reliability engineering for a wide range of software and service organizations, with the last 15 years focused on SaaS software businesses with access to sensitive customer data.
−Removed: The DCSDP also has 30 years in IT with the last 12 focused on compliance and data privacy issues for Certara.
−Removed: T able of Contents
−Removed: The VP of Information Technology and DCSDP also have a reporting responsibility to the General Counsel, and the Board via the Audit Committee.
−Removed: They coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the SPPO, the Board, the Audit Committee, and other stakeholders on a quarterly basis, or more frequently as needed.
−Removed: We have established processes to ensure that management is informed about and monitors cybersecurity incident prevention, detection, mitigation, and remediation.
−Removed: These processes include regular reporting, escalation, and communication protocols, as well as periodic reviews and audits of the security and privacy program.
+Added: We have established a corporate governance structure that provides oversight and guidance for our cybersecurity and data privacy program.
+Added: Our Board of Directors (the “Board”) is responsible for the oversight of our cybersecurity and privacy program and risks from cybersecurity threats.
+Added: Our Board’s Audit Committee, which supports the Board in its oversight of our cybersecurity and data privacy program, is focused on cybersecurity and data privacy risk, including incident response planning, and timely identification and assessment of cybersecurity threats, cybersecurity incident recovery and business continuity considerations.
+Added: We have defined roles and responsibilities for our assessment and management of risks related to cybersecurity threats, including specific executive-level and management-level positions or committees.
+Added: Our cybersecurity and privacy program is overseen by our Security and Privacy Program Office (“SPPO”) , which is composed of corporate leadership from legal and information technology (“IT”).
+Added: The SPPO reports to our Head of Information Technology, who is the accountable executive for our cybersecurity program.
+Added: Our function and business unit executive leadership, acting in support of our SPPO, is responsible for ensuring organizational compliance with data protection safeguard regulations and related risk controls across our organization.
+Added: Our Head of Information Technology and our Director, Compliance Standards & Data Privacy (“DCSDP”), are responsible for the design, implementation, and monitoring of the cybersecurity and data privacy policies, standards, procedures, and controls that govern our information systems and data processing activities.
+Added: Our Head of Information Technology has more than 30 years of experience in IT infrastructure, cybersecurity operations, and site reliability engineering for a wide range of software and service organizations, with the last 16 years focused on SaaS software businesses with access to sensitive customer data.
+Added: The DCSDP also has over 30 years in IT with the last 13 focused on compliance and data privacy issues for Certara.
+Added: Our Head of Information Technology and DCSDP report to our General Counsel, as well as to our Board through its Audit Committee.
+Added: The IT Security team and DCSDP coordinate the response and remediation of cybersecurity incidents and data breaches and report on the status and effectiveness of the security and privacy program to the SPPO, the Board and the Audit Committee on a quarterly basis, or more frequently as needed.
+Added: We have established processes to ensure that management is informed about and monitors cybersecurity threat prevention, detection, mitigation, and, if necessary, cybersecurity incident remediation.
+Added: These processes include regular reporting, escalation, and communication protocols, as well as periodic reviews and audits of our cybersecurity and data privacy program.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.