3 unchanged sentences
Cybersecurity is an important element of the Company’s overall enterprise risk management program.
−Removed: The Company has a multilayered system to assess, identify, and manage cybersecurity risks.
+Added: The Company has a multilayered system intended to assess, identify, and manage cybersecurity risks.
The system is designed to help protect the Company’s information assets and operations from internal and external cyber threats.
4 unchanged sentences
The Company annually assesses its cybersecurity program and safeguards against the National Institute of Standards of Technology Cybersecurity Framework (the “Framework”).
−Removed: The Company's cyber incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes intended to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations.
+Added: The Company's cyber incident response plan is designed to help coordinate our response to, and recovery from, cybersecurity incidents, and includes processes intended
+Added: to triage, assess the severity of, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations.
The Company endeavors to continually refine its policies and practices to help protect its platform, adapt to changes in regulations, identify potential and emerging security risks, and develop mitigations for those risks.
−Removed: For example, the Company seeks to conduct incident simulations and assessments annually to help discover potential vulnerabilities, with the objective to improve decision-making and prioritize and promote the monitoring and reporting across compliance functions.
+Added: For example, the Company seeks to conduct incident simulations and assessments regularly to help discover potential vulnerabilities, with the objective to improve decision-making and prioritize and promote the monitoring and reporting across compliance functions.
As part of its overall risk mitigation strategy, the Company also maintains cyber insurance coverage.
8 unchanged sentences
Also, depending upon the nature of the relationship and data, third party agreements include security and privacy provisions that oblige third parties to abide with applicable regulations and employ reasonable security controls.
−Removed: The Company’s Board of Directors does not believe that there are currently any risks from cybersecurity threats that are reasonably likely to materially affect the Company or its business strategy, financial condition, results of operations, or cash flows.
+Added: The Company’s Board of Directors does not believe that there are currently any risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company or its business strategy, financial condition, results of operations, or cash flows.
+Added: However, we have been the target of cybersecurity incidents and we expect them to continue as cybersecurity threats continue to evolve.
+Added: We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that we will not experience such an incident in the future.
+Added: For more information on the risks from cybersecurity threats that we face, refer to Part I, Item 1A.
+Added: Risk Factors.
Governance and Oversight
6 unchanged sentences
The CISO holds a Master of Business Administration, as well as Certified Information Systems Security Professional, Certified Information Systems Auditor, and Certified Information Security Manager cybersecurity-related certifications.
−Removed: The CISO also serves as a Director for the RH-ISAC.
+Added: The CISO also serves as Chair of the Board for RH-ISAC.
The Company has also established a cross-functional cybersecurity oversight committee led by our CISO serving as the chair and consisting of executive-level leaders, that is responsible for the Company’s cybersecurity, disaster recovery, and business continuity programs.
The Company’s internal audit team also provides independent assurance on the functional components of the Company’s cybersecurity program and reports the results of these audits in its quarterly reports to the Audit Committee.
−Removed: In an effort to prevent and detect cyber threats, the Company annually provides all employees, including part-time and temporary, with cybersecurity and privacy training, which covers timely and relevant topics, including social engineering, phishing, password protection, data protection, physical security, and educates employees on the importance of reporting all incidents immediately.
+Added: In an effort to prevent and detect cyber threats, the Company annually provides all employees, including part-time and temporary, with cybersecurity and privacy training, which covers timely and relevant topics, including social engineering,
+Added: phishing, password protection, data protection, physical security, and educates employees on the importance of reporting all incidents immediately.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.