3 unchanged sentences
These threats include both those typical of companies operating in many industries, like ransomware and denial-of-service attacks, as well as more sophisticated and persistent threats from highly organized adversaries that specifically target the healthcare sector and other critical infrastructure.
−Removed: Our suppliers, third-party vendors, service providers, customers, and other business partners (collectively, our "third-party business partners") are also vulnerable to similar cybersecurity risks, and any cyber incident affecting us and/or our third-party business partners could significantly disrupt our operations.
+Added: The emergence of artificial intelligence has provided additional tools for those who perpetrate these attacks, including through social engineering, the development of customized malware, and an enhanced ability to evade detection.
+Added: Our suppliers, third-party vendors, service providers, customers, contractors, those who work for our contractors, and other business partners (collectively, our “third-party business partners”) are also vulnerable to similar cybersecurity risks, and any cyber incident affecting us and/or our third-party business partners could significantly disrupt our operations.
In light of these risks, cybersecurity is a priority for the Company, management, and our Board of Directors (the “Board”), and we believe that it is essential for us to invest substantial resources in our cybersecurity efforts.
10 unchanged sentences
These assessments encompass evaluations of both the design and operational effectiveness of our security measures.
+Added: They also consider the evolution of different cybersecurity threats, including through artificial intelligence.
Additionally, we are a member of H-ISAC, an industry cybersecurity intelligence and risk-sharing organization, which enables us to stay informed about developments, trends, and risks in the cybersecurity threat landscape and consider any necessary updates to our information security program related thereto.
We are committed to employing cybersecurity best practices and have obtained and maintain multiple industry best practice cybersecurity certifications such as ISO 27001and SOC1/SOC2.
−Removed: Under the leadership of our CDIO and CISO, and with oversight, as appropriate, from the Board’s Audit Committee, we have developed a Cybersecurity Incident Response Process (the "Response Process"), which sets forth a detailed and comprehensive framework for the actions to be taken in response to a cybersecurity incident and includes appropriate escalations to the Company’s senior management, including our ECCRT (as defined below), and the Board.
−Removed: Under the guidance of our CISO, the Response Plan is routinely evaluated and updated as appropriate.
−Removed: In addition to our Response Plan, which is employed in the event of a cybersecurity incident, we take preventative measures that are designed to mitigate the likelihood and prevalence of cybersecurity incidents.
+Added: Under the leadership of our CDIO and CISO, and with oversight, as appropriate, from the Board’s Audit Committee, we have developed a Cybersecurity Incident Response Process (the “Response Process”), which sets forth a framework for the actions to be taken in response to a cybersecurity incident and includes appropriate escalations to the Company’s senior management, including our ECCRT (as defined below), and the Board.
+Added: Under the guidance of our CISO, the Response Process is routinely evaluated, tested and updated as appropriate.
+Added: In addition to our Response Process, which is employed in the event of a cybersecurity incident, we take preventative measures that are designed to mitigate the likelihood and prevalence of cybersecurity incidents.
For example, we believe that enterprise-wide cybersecurity and privacy training serve an important role in risk reduction.
6 unchanged sentences
This program is designed to conduct appropriate due diligence on the third-party business partners with whom we engage and conduct business, as well as on the systems and the cybersecurity controls of such third-party business partners.
−Removed: Specifically, to evaluate third-party cybersecurity controls, we utilize third-party cybersecurity monitoring and alerting tools, cybersecurity due diligence questionnaires, and request and review third-party audit reports and assurance certifications if they exist.
−Removed: Our information systems have been subject to cybersecurity incidents in the past, including the incident disclosed in February 2024 relating to certain exfiltrated data.
−Removed: The incident has not had a material impact on the Company’s operations and, as previously disclosed, we do not believe that the incident is reasonably likely to materially impact our financial condition or results of operations.
+Added: Specifically, to evaluate third-
+Added: party cybersecurity controls, we utilize third-party cybersecurity monitoring and alerting tools, cybersecurity due diligence questionnaires, and request and review third-party audit reports and assurance certifications if they exist.
+Added: Our information systems have been subject to cybersecurity incidents in the past.
+Added: To date, we are not aware of cybersecurity incidents that have materially affected or are reasonably likely to materially affect us.
However, there is no guarantee that future cybersecurity incidents will not have a material impact.
4 unchanged sentences
As described above, our CDIO leads management’s assessment and management of cybersecurity with the assistance of our CISO, who reports directly to the CDIO and meets with the CDIO on a regular basis to discuss pertinent risks, mitigation factors, remediation status, and risk acceptance.
−Removed: The CDIO, who reports directly to our President and Chief Executive Officer, is a member of the Executive Leadership Team (the "ELT") and provides updates to the ELT about cybersecurity matters.
+Added: The CDIO, who reports directly to our President and Chief Executive Officer, is a member of the Enterprise Leadership Team (the “ELT”) and provides updates to the ELT about cybersecurity matters.
Our CDIO has more than 25 plus years of experience managing technology and risks and advising on cybersecurity issues, and our CISO has more than 20 plus years of IT and relevant cybersecurity experience.
−Removed: Additionally, we have established the Extended Cyber Crisis Response Team ("ECCRT").
−Removed: The ECCRT is a cross-functional incident response team comprised of senior leaders from across the various departments of the organization that, in the event of a cyber incident, helps lead the decision-making process for the execution of containment and recovery processes and incident communications, including reporting to senior management and, in turn, the Board, as appropriate, in each case in accordance with the protocols set forth in our Response Process.
+Added: Additionally, we have an Extended Cyber Crisis Response Team (“ECCRT”), which is a cross-functional team comprised of senior leaders that, in the event of a cyber incident, help lead the decision-making process for the execution of containment and recovery processes and incident communications, including reporting to senior management and, in turn, the Board, as appropriate, in each case in accordance with the protocols set forth in our Response Process.
Cybersecurity is among the risks identified by our Enterprise Risk Management Team for Board-level oversight.
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.