3 unchanged sentences
As part of our overall “Enterprise Risk Management” program, the Company has implemented a cybersecurity risk management program that is informed by recognized industry standards and frameworks.
−Removed: Our cybersecurity risk
−Removed: Table of Content
−Removed: management program includes a number of components, including information security program assessments, penetration testing, and threat simulation exercises that are conducted periodically by both internal and external resources , as well as continuous monitoring of critical risks from cybersecurity threats using automated tools.
+Added: Our cybersecurity risk management program includes a number of components, including information security program assessments, penetration testing, and threat simulation exercises that are conducted periodically by both internal and external resources , such as cybersecurity industry vendors, consultants, and auditors, as well as continuous monitoring of critical risks from cybersecurity threats using automated tools.
During onboarding and periodically thereafter, we conduct trainings for the Company’s employees and contractors about cybersecurity risks, including sending test phishing emails for training purposes to all users of the Company’s email system.
4 unchanged sentences
For more information about the cybersecurity risks we face, see the risk factor entitled “Information security breaches may adversely affect our business” in Item 1A- Risk Factors.
−Removed: Our cybersecurity risk management program and related operations and processes are managed by our Information Security team (the “IS Team”), which is led by the Senior Director of Information Security.
−Removed: The Senior Director of Information Security role is currently held by an individual who has over fifteen years of experience managing information security programs.
+Added: Our cybersecurity risk management program and related operations and processes are managed by our Information Security team (the “IS Team”), which is led by the Senior Director of Information Security and supported by internal resources and external vendors, auditors, and consulting engagements when appropriate.
+Added: The Senior Director of Information Security role is currently held by an individual who has over twenty years of experience managing information security programs.
The IS Team is responsible for assessing risks from cybersecurity threats, including their potential business impact and likelihood of occurrence, as well as implementing risk mitigations and remediations.
1 unchanged sentence
The IS Team provides reports on a semi-annual basis to the Audit Committee , which oversees cybersecurity risks pursuant to the Audit Committee Charter .
−Removed: The Audit Committee periodically reports on cybersecurity risk management to the full Board of Directors.
−Removed: The Board of Directors, as a whole and through its committees, has responsibility for the oversight of risk management.
+Added: The Audit Committee periodically reports on cybersecurity risk management to the full Board of Directors of the Company (the "Board").
+Added: The IS team also provides an annual direct report on cybersecurity risk management to the Board.
+Added: The Board, as a whole and through its committees, has responsibility for the oversight of risk management.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.