2 unchanged sentences
Risk Management Strategy and Framework
−Removed: ChargePoint relies on critical internal and third-party information technology systems, including its Cloud Services, mobile applications, networked charging systems and network operating system, to deliver its products and services to charging station owners and EV drivers.
−Removed: In addition, ChargePoint stores and maintains personal, confidential and private information, including information related to its customers, vendors, mobile application users and employees.
+Added: ChargePoint relies on critical internal and third-party information technology systems, including its ChargePoint Platform, mobile applications, networked charging systems and network operating system, to deliver its products and services to charging station owners and EV drivers.
+Added: In addition, ChargePoint stores and maintains personal, confidential and private information, including
+Added: Table of Content
+Added: information related to its customers, vendors, mobile application users and employees.
ChargePoint refers to the foregoing as its “IT Infrastructure and Confidential Information.”
To safeguard the privacy and security of ChargePoint’s IT Infrastructure and Confidential Information, ChargePoint has implemented a nine-point information security management program designed to identify cybersecurity threats, assess risks, implement remediation measures, and to support internal or external reporting, as set forth below:
−Removed: • Product & Application Security – focuses on building capabilities to detect, mitigate, and monitor security risks to ChargePoint’s hardware (networked charging stations, embedded devices, and telematics devices) and software (Cloud Services, web and mobile) products.
+Added: • Product & Application Security – focuses on building capabilities to detect, mitigate, and monitor security risks to ChargePoint’s hardware (networked charging stations, embedded devices, and telematics devices) and software (ChargePoint Platform, web and mobile) products.
ChargePoint conducts internal and external penetration tests, scans code and runs an active bug bounty program to detect security flaws within its architecture, design, and product components.
ChargePoint’s comprehensive risk management plan then associates identified findings to ChargePoint’s risk mitigation roadmaps;
−Removed: • Cloud & IT Infrastructure Security – focuses on detecting, mitigating, and monitoring risks to ChargePoint’s critical information technology and Cloud infrastructure that supports its network and products.
+Added: • ChargePoint Platform & IT Infrastructure Security – focuses on detecting, mitigating, and monitoring risks to ChargePoint’s critical information technology and cloud infrastructure that supports its network and products.
ChargePoint has configured tools to continuously scan its cloud infrastructure operating systems, containers, and code pipeline to detect vulnerabilities and software flaws, which are then remediated through its patch management program;
6 unchanged sentences
• End User Security Risks – focuses on building capabilities to detect, monitor and mitigate security risks that arise from negligence and malicious insider intent.
−Removed: In addition to securing endpoints and their access to ChargePoint’s network environment, ChargePoint implements an active cybersecurity training and awareness program for its workforce which
−Removed: Table of Content
−Removed: includes cybersecurity awareness training for all employees during onboarding and then annually thereafter.
+Added: In addition to securing endpoints and their access to ChargePoint’s network environment, ChargePoint implements an active cybersecurity training and awareness program for its workforce which includes cybersecurity awareness training for all employees during onboarding and then annually thereafter.
Similarly, each employee that has access to ChargePoint’s payment processing information technology environment or dedicated federal cloud environment are provided specific PCI DSS and FedRAMP awareness training prior to being granted such access and annually thereafter.
1 unchanged sentence
• Third-Party Security Risks – focuses on building capabilities to detect, mitigate, and monitor security risks that arise from vendors and suppliers.
−Removed: All ChargePoint third-party service providers are subject to a ranking and risk assessment evaluation prior to contracting with such service provider, during which time, ChargePoint assesses the third-party service providers’ security posture, practices, and relevant certifications;
+Added: ChargePoint third-party service providers are subject to a ranking and risk assessment evaluation prior to contracting with such service provider, during which time, ChargePoint assesses the third-party service providers’ security posture, practices, and relevant certifications;
• Cyber Threats – focuses on building cyber threat identification capabilities by, among other methods, implementation of manual and automated tools, subscribing to reports and services to identify, detect, monitor and mitigate cyber threats in ChargePoint’s environment on an ongoing basis.
7 unchanged sentences
ChargePoint remains committed to continuously enhancing its information security management program to safeguard its IT Infrastructure and Confidential Information.
+Added: Table of Content
Cybersecurity Leadership and Management
−Removed: ChargePoint’s information security management programs are designed and implemented by its Chief Information Security Officer (CISO) and Sr.
−Removed: Director, Information, Security and Privacy, who, combined, have thirty-three years of experience in information technology security and privacy.
+Added: ChargePoint’s information security management programs are designed and implemented by its Chief Information Security Officer (CISO) .
ChargePoint’s management team, including its information technology (IT) management team, is responsible for assessing and managing its material risks from cybersecurity threats.
2 unchanged sentences
ChargePoint’s IT Infrastructure and Confidential Information is managed and secured across functional reporting lines with segregated duties for responsible individuals for (1) cloud security, SOC, and individual access management, (2) governance, risk, compliance and privacy, (3) product security, and (4) infrastructure.
−Removed: ChargePoint’s risk assessment methodology implements continuous reporting requirements of ChargePoint’s cybersecurity risk management performance, which includes (i) a quarterly risk program status report to ChargePoint’s CISO and Sr.
−Removed: Director, Information, Security and Privacy and (ii) executive reports by both the CISO and Sr.
−Removed: Director, Information Security and Privacy on ChargePoint’s cybersecurity risk posture to executive leadership no less than every six months.
+Added: ChargePoint’s risk assessment methodology implements continuous reporting requirements of ChargePoint’s cybersecurity risk management performance, which includes (i) a quarterly risk program status report to ChargePoint’s CISO and (ii) executive reports by the CISO on ChargePoint’s cybersecurity risk posture to executive leadership no less than every six months.
Board Oversight of Cybersecurity Risk
2 unchanged sentences
The CISO provides updates on ChargePoint’s information security management program to the Audit Committee at least every six months and additional updates throughout the year as necessary.
−Removed: For further information regarding the risks to ChargePoint associated with cybersecurity incidents and other events, including information and security breaches, and how such risks may affect ChargePoint, see the Risk Factors in Part 1, Item 1A of this Annual Report on Form 10-K entitled, “ChargePoint is highly reliant on its networked charging solution and information technology systems and
−Removed: Table of Content
−Removed: data, and those of its service providers and component suppliers, any of which systems and data may be subject to cyber-attacks, service disruptions or other security incidents, which could result in data breaches, loss or interruption of services, intellectual property theft, claims, litigation, regulatory investigations, significant liability, reputational damage and other adverse consequences” and “Computer malware, viruses, ransomware, hacking, phishing attacks and similar disruptions could result in security and privacy breaches and interruption in service, which could harm ChargePoint’s business.” To date, ChargePoint has not identified any risks from a cybersecurity threat or incident, that the Company believes has, or is reasonably likely to, materially affect ChargePoint, its business strategy, results of operation or financial condition.
+Added: For further information regarding the risks to ChargePoint associated with cybersecurity incidents and other events, including information and security breaches, and how such risks may affect ChargePoint, see the Risk Factors in Part 1, Item 1A of this Annual Report on Form 10-K entitled, “ChargePoint is highly reliant on its networked charging solution and information technology systems and data, and those of its service providers and component suppliers, any of which systems and data may be subject to cyber-attacks, service disruptions or other security incidents, which could result in data breaches, loss or interruption of services, intellectual property theft, claims, litigation, regulatory investigations, significant liability, reputational damage and other adverse consequences” and “Computer malware, viruses, ransomware, hacking, phishing attacks and similar disruptions could result in security and privacy breaches and interruption in service, which could harm ChargePoint’s business.” To date, ChargePoint has not identified any risks from a cybersecurity threat or incident, that the Company believes has, or is reasonably likely to, materially affect ChargePoint, its business strategy, results of operation or financial condition .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.