2 unchanged sentences
We consider cybersecurity protection, including protection of customer, employee, and partner information, to be a priority in the Company’s business, strategy, and management.
−Removed: Carvana's enterprise risk management program, which is designed to identify, evaluate, and respond to our high priority risks and opportunities, integrates assessment, review, identification and management of cybersecurity risks.
−Removed: While management is responsible for the day-to-day handling of our risk management program, the Board of Directors, as a whole and through its committees, oversees risk management, including cybersecurity risks.
+Added: Carvana's enterprise risk management program, is designed to identify, assess, prioritize, and respond to significant risks and opportunities, and incorporates processes for the identification, evaluation, and management of risks from cybersecurity threats, including those arising from third-party service providers and vendors.
+Added: While management is responsible for the day-to-day handling of our risk management program, the Board, as a whole and through its committees, oversees risk management, including cybersecurity risks.
The Board has delegated certain risk management responsibilities with respect to cybersecurity to the Audit Committee, which is responsible for ensuring sufficient oversight of our cybersecurity risk exposures.
The Audit Committee leads the full Board in periodic reviews of the adequacy and effectiveness of our information security program and internal controls, including quarterly and ad hoc updates of cybersecurity risks, initiatives, and key metrics.
−Removed: Senior leaders from our Information Security, Legal, Privacy, and Compliance teams provide the Board and Audit Committee with periodic briefings of our current risks and security strategy, as well as future plans with regard to cybersecurity posture, preparation, prevention, and incident response.
−Removed: O ur Chief Information Security Officer ("CISO") , who has extensive cybersecurity knowledge and experience, with over 15 years in the field of information security, including over seven years of experience leading information security departments within financial services and technology organizations as a cybersecurity executive, is primarily responsible for assessing and managing cybersecurity risk.
+Added: Senior leaders from our Information Security, Legal, Privacy, and Compliance teams provide the Board and Audit Committee with periodic briefings on the threat landscape, our security strategy and roadmap, and the status of risk reduction initiatives, including preparation, prevention, detection, response, and recovery activities.
+Added: Our Chief Information Security Officer ("CISO") , who has extensive cybersecurity knowledge and experience, including over 16 years in the field of information security and over eight years of experience leading enterprise security programs in financial services and technology organizations, is primarily responsible for assessing and managing cybersecurity risk.
The CISO oversees a team of dedicated information security professionals (the “Information Security Team”) who focus on specialty areas such as application security, security compliance, security architecture and engineering, vulnerability management, and security operations, each with relevant experience and industry certifications in their respective areas.
1 unchanged sentence
It partners with a variety of business units, including our Engineering, Legal, Privacy, Compliance, Internal Audit, Technology, and Product teams to identify and control emerging risks.
−Removed: The Information Security and privacy teams also from time to time engage consultants and other third parties to assist in investigating and remediating security incidents, monitoring of security vulnerabilities, and performing risk assessments based on industry standards such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework.
+Added: The Information Security and privacy teams also from time to time engage consultants and other third parties to assist in investigating and remediating security incidents, monitoring of security vulnerabilities, and performing annual internal and external penetration tests based on best practices and industry standards such as the Open Web Application Security Project (OWASP) Top Ten.
Our Information Governance Committee, whose members include representatives from the Information Security Team and key senior leaders from relevant stakeholder groups, meets quarterly to review and discuss, among other topics, the implementation and management of these cybersecurity processes.
2 unchanged sentences
In implementing these policies, the Information Security Team utilizes a layered approach, aided by industry leading technology, to detect, respond, and prevent cybersecurity risks and exposures.
−Removed: As of the date hereof, we have not experienced any material cybersecurity incidents.
+Added: Upon hire and annually thereafter, employees are assigned Information Security and Privacy Awareness Training to provide awareness on topics such as social engineering, phishing, password requirements, ethical use of artificial intelligence, physical security, best practices for secure remote work, protecting sensitive information, and identifying and reporting potential issues.
+Added: Phishing simulations are also conducted on an ongoing basis.
+Added: As of the date hereof, we have not identified any material cybersecurity incidents impacting the Company.
However, future incidents, whether direct or through our third-party providers, could have a material impact on our business strategy, results of operations, or financial condition.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.