3 unchanged sentences
ChargePoint relies on critical internal and third-party information technology systems, including its ChargePoint Platform, mobile applications, Networked Charging Systems and network operating system, to deliver its products and services to charging station owners and EV drivers.
−Removed: In addition, ChargePoint stores and maintains personal, confidential and private information, including
−Removed: Table of Content
−Removed: information related to its customers, vendors, mobile application users and employees.
+Added: In addition, ChargePoint stores and maintains personal, confidential and private information, including information related to its customers, vendors, mobile application users and employees.
ChargePoint refers to the foregoing as its “IT Infrastructure and Confidential Information.”
10 unchanged sentences
As of January 2026, ChargePoint’s information security management programs have been certified as compliant with the ISO:
−Removed: 27001, SOC 2 Type 2, PCI DSS standards and with the Federal Risk and Authorization Management Program (FedRAMP);
+Added: 27001, SOC 2 Type 2, PCI DSS v4.0.1 standards and with the Federal Risk and Authorization Management Program (FedRAMP);
+Added: Table of Content
• End User Security Risks – focuses on building capabilities to detect, monitor and mitigate security risks that arise from negligence and malicious insider intent.
−Removed: In addition to securing endpoints and their access to ChargePoint’s network environment, ChargePoint implements an active cybersecurity training and awareness program for its workforce which includes cybersecurity awareness training for all employees during onboarding and then annually thereafter.
+Added: In addition to securing endpoints and their access to ChargePoint’s network environment, ChargePoint implements an active cybersecurity training and awareness program for its workforce which includes cybersecurity and privacy awareness training for all employees during onboarding and then annually thereafter.
Similarly, each employee that has access to ChargePoint’s payment processing information technology environment or dedicated federal cloud environment are provided specific PCI DSS and FedRAMP awareness training prior to being granted such access and annually thereafter.
11 unchanged sentences
ChargePoint remains committed to continuously enhancing its information security management program to safeguard its IT Infrastructure and Confidential Information.
−Removed: Table of Content
Cybersecurity Leadership and Management
ChargePoint’s information security management programs are designed and implemented by its Chief Information Security Officer (CISO) .
−Removed: ChargePoint’s management team, including its information technology (IT) management team, is responsible for assessing and managing its material risks from cybersecurity threats.
+Added: ChargePoint’s management team, including its executive management and information technology (IT) management team, is responsible for assessing and managing its material risks from cybersecurity threats.
The IT management team has primary responsibility for ChargePoint’s overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and retained external cybersecurity consultants.
6 unchanged sentences
The CISO provides updates on ChargePoint’s information security management program to the Audit Committee at least every six months and additional updates throughout the year as necessary.
−Removed: For further information regarding the risks to ChargePoint associated with cybersecurity incidents and other events, including information and security breaches, and how such risks may affect ChargePoint, see the Risk Factors in Part 1, Item 1A of this Annual Report on Form 10-K entitled, “ChargePoint is highly reliant on its networked charging solution and information technology systems and data, and those of its service providers and component suppliers, any of which systems and data may be subject to cyber-attacks, service disruptions or other security incidents, which could result in data breaches, loss or interruption of services, intellectual property theft, claims, litigation, regulatory investigations, significant liability, reputational damage and other adverse consequences” and “Computer malware, viruses, ransomware, hacking, phishing attacks and similar disruptions could result in security and privacy breaches and interruption in service, which could harm ChargePoint’s business.” To date, ChargePoint has not identified any risks from a cybersecurity threat or incident, that the Company believes has, or is reasonably likely to, materially affect ChargePoint, its business strategy, results of operation or financial condition .
+Added: For further information regarding the risks to ChargePoint associated with cybersecurity incidents and other events, including information and security breaches, and how such risks may affect ChargePoint, see the Risk Factors in Part 1, Item 1A of this Annual
+Added: Table of Content
+Added: Report on Form 10-K entitled, “ChargePoint is highly reliant on its networked charging solution and information technology systems and data, and those of its service providers and component suppliers;
+Added: any of these systems and data may be subject to cyber-attacks, service disruptions or other security incidents, which could result in data breaches, loss or interruption of services, intellectual property theft, claims, litigation, regulatory investigations, significant liability, reputational damage and other adverse consequences” and “Computer malware, viruses, ransomware, hacking, phishing attacks and similar disruptions could result in security and privacy breaches and interruption in service, which could harm ChargePoint’s business.” To date, ChargePoint has not identified any risks from a cybersecurity threat or incident, that the Company believes has, or is reasonably likely to, materially affect ChargePoint, its business strategy, results of operation or financial condition .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.