2 unchanged sentences
Our Board of Directors (the “Board”) and management recognize the importance of maintaining the trust and confidence of our clinical trial participants, investors, business partners and employees.
−Removed: The Board and the Audit Committee of the Board (the “Audit Committee”) are actively involved in oversight of our cybersecurity program as part of our approach to risk management.
−Removed: Our cybersecurity policies, processes and practices are integrated into our operations and are based on recognized standards such as the National Institute of Standards and Technology Cybersecurity Framework.
−Removed: In general, we seek to address cybersecurity risks through a comprehensive, coordinated approach that is focused on preserving the confidentiality, integrity, security, and availability of our critical systems and the information that we create through our business operations by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
+Added: The Board and the Audit Committee of the Board (the “Audit Committee”) are involved in oversight of our cybersecurity program as part of our approach to risk management.
+Added: In general, we seek to address cybersecurity risks through a comprehensive cybersecurity risk management program intended to protect the confidentiality, integrity, security and availability of our critical systems and the information that we create through our business operations by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
Risk Management and Strategy
−Removed: We design and assess our program based on the National Institute of Standards and Technology’s Cybersecurity Framework (“NIST CSF”).
+Added: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”).
This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
−Removed: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
+Added: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.
Key elements of our cybersecurity risk management program include, but are not limited to, the following:
• A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents;
−Removed: • The utilization of Microsoft 365 services for email, data storage, Identity Provider (“IdP”) for Single Sign-On (“SSO”), and other technical controls such as remote user and device management;
+Added: • The utilization of Microsoft 365 services for email, data storage, Identity Provider for Single Sign-On, and other technical controls such as remote user and device management;
+Added: • Mandatory multi-factor authentication (“MFA”) for all remote access and privileged accounts, and MFA or comparable controls for all user accounts;
• Microsoft 365 configurations which are aligned with security and industrial standards, including automatic risk management mechanisms and alert notifications for our Information Technology (“IT”) team;
1 unchanged sentence
• Privileged access management protocols that require user access requests to receive formal, documented approvals with specific business justifications and, following receipt of such approvals, the provision of only the minimum access necessary for the approved purpose;
+Added: • The utilization of Rapid7 Managed Detection and Response, Bitsight, Cynomi Governance, Risk and Compliance, Harmony Email & Collaboration, annual Microsoft 365 security assessments, vCISO services, and other related solutions, to continuously monitor and strengthen our security posture and proactively manage risk;
+Added: • Continuous vulnerability scanning and remediation tracking, supplemented by annual third-party risk assessments and penetration testing;
• Regular monitoring of our Microsoft security score, which serves as a benchmark for our security posture and guides our continuous improvement efforts;
−Removed: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment, including annual external assessments and vulnerability scanning;
+Added: • Risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information;
• A security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our response to cybersecurity incidents;
−Removed: • Regular security awareness training sessions for users, including simulated phishing email campaigns managed by KnowBe4, a third-party leader in security awareness training;
+Added: • Regular security awareness training sessions for employees, including incident response personnel and senior management (such as simulated phishing email campaigns managed by KnowBe4, a third-party leader in security awareness training);
• A disaster recovery program, including business continuity procedures in the event of a disaster, backup procedures, failover features with up-to-date SaaS services, and data recovery protocols;
−Removed: • A third-party risk management (“TPRM”) process to safeguard against risks posed by service providers, suppliers and vendors, based on our assessment of their respective criticality to our operations and respective
−Removed: risk profile, encompassing risk identification, due diligence and risk assessment prior to engagement, and categorization of third parties based on risk levels .
−Removed: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
+Added: • A third-party risk management process to safeguard against risks posed by key service providers, based on our assessment of their respective criticality to our operations and respective risk profile, encompassing risk identification, due diligence and risk assessment prior to engagement, categorization of third parties based on risk levels, and ongoing monitoring of critical third parties, including review of SOC 2 reports, cybersecurity insurance coverage and period reassessment;
+Added: • Annual penetration testing conducted by a qualified third-party provider, with results reported to the Audit Committee;
+Added: • Deployment of endpoint detection and response capabilities across workstations and servers with continuous 24/7 monitoring;
+Added: • Cybersecurity insurance coverage that we believe is appropriate for a clinical-stage biotechnology company of our size, stage and risk profile.
+Added: We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.
We did not experience any material IT security incidents during the fiscal year.
2 unchanged sentences
Cybersecurity Governance
−Removed: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.
−Removed: The Audit Committee oversees management’s implementation of our cybersecurity risk management program.
+Added: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including management’s implementation of our cybersecurity risk management program.
The Audit Committee receives periodic reports from management on our cybersecurity risks, and our IT team directly reports to the Audit Committee on a periodic basis.
−Removed: In addition, management is obligated to update the Audit Committee, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.
+Added: In addition, management updates the Audit Committee, where appropriate, regarding any significant cybersecurity incidents it considers to be significant or potentially significant.
The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.
−Removed: The full Board also receives briefings from management on our cyber risk management program.
+Added: The full Board also periodically receives briefings from management on our cyber risk management program.
Board members receive presentations on cybersecurity topics from internal staff as part of the Board’s continuing education on topics that impact public companies.
−Removed: Our Director of Information Technology , who reports to our principal financial officer, leads the operational oversight of Company-wide cybersecurity strategy, policy, standards, and processes and works across relevant departments to assess, manage, and help prepare us and our directors and employees to address, cybersecurity risks.
+Added: Our Director of Information Technology , who reports to our principal financial officer, leads the operational oversight of Company-wide cybersecurity risk management program, and works across relevant departments to assess, manage, and help prepare our directors, internal cybersecurity personnel and retained external cybersecurity consultants to address cybersecurity risks.
Specific cybersecurity related responsibilities of the Director of Information Technology include overseeing our processes and strategies for the detection, mitigation, and remediation of cybersecurity incidents.
Our Director of Information Technology has over 25 years of diverse experience in information technology, including management roles at managed service providers, enabling him to effectively oversee cybersecurity risks and threats.
−Removed: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.
+Added: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.