12 unchanged sentences
• phishing simulations;
−Removed: and a cybersecurity incident response team.
+Added: • a cybersecurity incident response team.
The Company also engages third-party vendors and consultants, respectively, to perform audits and penetration tests.
1 unchanged sentence
We maintain a third-party vendor security risk management program to assess the cybersecurity risk and measures taken by such service providers.
−Removed: The program includes a dedicated third-party risk assessor, security risk reports, and formal business owner risk response.
+Added: The program includes a third-party risk assessor, security risk reports, and formal business owner risk response.
During the period covered by this report, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.
1 unchanged sentence
For additional information related to risks from cybersecurity threats, please refer to Item 1.A.
−Removed: — “Risks Related to Our Business and Industry — Our failure to protect our sites, networks, and systems against security breaches, or otherwise to protect our confidential or health information or the confidential or health information of our beneficiaries, providers, or other third parties, would damage our reputation and brand, and substantially harm our business and results of operations.
+Added: — “Risks Related to Our Business and Industry — Our failure to protect our sites, networks, and systems against security breaches, or otherwise to protect our confidential or health information or the confidential or health information of our members, providers, or other third parties, could damage our reputation and brands, and substantially harm our business and results of operations.
The Company’s Board of Directors (the “Board”) oversees the Company’s overall risk management program, and has assigned oversight of cybersecurity risk management to its Audit Committee.
−Removed: The Audit Committee reviews the adequacy and effectiveness of the Company’s cybersecurity policies and internal controls regarding information and cybersecurity, and together with the full Board, regularly receives reports from our and our subsidiaries’ management, including our Chief Information Security Officer (the “CISO”) on cybersecurity matters, including, but not limited to:
−Removed: Security Awareness, Internal Risk, Third-Party Risk, IR / DR Readiness, Access Control IAM/PAM, HIPAA Security Rule Compliance, Phishing, Security Monitoring, Vulnerability Management, Application Security, Governance, Data Security, and Cloud Security.
+Added: The Audit Committee reviews the adequacy and effectiveness of the Company’s cybersecurity policies and internal controls regarding information and cybersecurity, and together with the full Board, regularly receives reports from our management, including our Chief Information Security Officer (the “CISO”) on cybersecurity matters, including, but not limited to:
+Added: AI Security, Security Awareness, Internal Risk, Third-Party Risk, IR / DR Readiness, Access Control IAM/PAM, HIPAA Security Rule Compliance, Phishing, Security Monitoring, Vulnerability Management, Application Security, Governance, Data Security, and Cloud Security.
The Company’s CISO is responsible for developing and managing the cybersecurity program, including security incident response, remediation, and setting security policy and standards required by applicable law or regulation.
−Removed: The CISO holds a dual-accredited Executive MBA, and Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certified Data Privacy Solutions Engineer (CDPSE) certifications.
+Added: The CISO holds a dual-accredited Executive MBA, and Certified Information Security Manager ("CISM"), Certified Information Systems Auditor ("CISA") and Certified Data Privacy Solutions Engineer ("CDPSE") certifications.
The security team holds multiple certifications including but not limited to CISSP, CRISC, CCSFP, and AWS CP, a bug bounty hall of fame member, and a range of experience with different firms.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.