17 unchanged sentences
These service providers assist us to design and implement our cybersecurity policies and procedures, as well as to monitor and test our safeguards and to conduct regular vulnerability assessments for our internal assets.
−Removed: We require each third-party service provider to give assurance that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.
−Removed: We review third-party service providers’ policies, data protection procedures, intellectual property protection measures and incident response measures.
−Removed: Our CISO oversees our relationships with these third-party service providers.
+Added: We manage third-party cybersecurity risk through a risk-based due diligence and oversight program led by our CISO.
+Added: Before engagement, we assess providers’ security controls in proportion to the sensitivity of the data and systems involved.
+Added: Where risks are elevated, we may require remediation, enhanced monitoring, or independent attestations as a condition of onboarding, and we may decline to engage or restrict access if risks cannot be adequately mitigated.
+Added: Our contracts require applicable service providers to maintain reasonable security measures, comply with relevant laws and standards, and promptly notify us of any actual or suspected security incident affecting our systems or data.
+Added: For higher-risk vendors, we conduct ongoing monitoring, and our CISO oversees remediation of any identified deficiencies.
While we are not aware of any material data security breaches to date, for additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, “Risk Factors,” in this annual report on Form 10-K , including the risk factors under the heading “Risks Related to Privacy, Data Protection and Cybersecurity,” which is incorporated herein by reference.
8 unchanged sentences
Our CISO and representatives from our steering committee on information security provide quarterly briefings to the audit committee regarding our company’s cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.
+Added: We maintain a comprehensive set of information security metrics to monitor and manage our cybersecurity program.
+Added: Management provides the Audit Committee with updates on key cybersecurity performance indicators on a quarterly basis.
Because many members of our board of directors regularly attend our audit committee meetings, the full board of directors regularly receives updates on cybersecurity.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.