9 unchanged sentences
We can provide no assurance that there will not be cybersecurity incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.
−Removed: Table of Con tents
Risk Management and Strategy
−Removed: Our approach for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management strategy and are based on commonly accepted frameworks established by the International Organization for Standardization (“ISO”), the National Institute of Standards and Technology (“NIST”), and other applicable industry standards.
+Added: Our approach for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management strategy and are based on commonly accepted frameworks established by the International Organization for Standardization, the National Institute of Standards and Technology, and other applicable industry standards.
Our cybersecurity program focuses on the following key areas:
1 unchanged sentence
Cybersecurity risks are identified and addressed comprehensively in a cross-functional approach.
−Removed: Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of Company and customer information.
+Added: Key security, risk, and compliance stakeholders meet regularly to develop strategies for preserving the confidentiality, integrity and availability of our
+Added: and our customer information.
We have controls and procedures in place to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.
7 unchanged sentences
We maintain appropriate incident response and recovery plans and periodically perform tests to evaluate the effectiveness of these plans.
−Removed: Our incident response and recovery plans include guidance to our employees, management, and the Board on response to cybersecurity incidents.
+Added: Our incident response and recovery plans include guidance to our employees, management, and our board on response to cybersecurity incidents.
Third-Party Risk Management
3 unchanged sentences
Education and Awareness
−Removed: Employees are regularly reminded of the importance of handling and protecting customer and Company data.
+Added: Employees are regularly reminded of the importance of handling and protecting customer and our data.
Employees receive appropriate policies and annual privacy and security training to enhance awareness and reinforce desired behaviors.
7 unchanged sentences
They contribute to risk assessments, help refine our security architecture, and provide valuable insights into industry best practices.
−Removed: Table of Con tents
Board Oversight
2 unchanged sentences
Management’s Role
−Removed: Our Chief Operating Officer , who serves as the Company’s designated chief information security officer (“CISO”) and our Director of Technology have primary responsibility for managing the Company’s cybersecurity program on an ongoing basis.
−Removed: Our Director of Technology has served in various roles in information technology and information security for over 15 years.
−Removed: He holds an undergraduate degree in Computer Science.
−Removed: Our Chief Operating Officer and designated CISO has served in various roles in information technology and information security for over 20 years, including serving as the Chief Information Security Officer and/or Chief Security Officer at other publicly traded technology companies.
+Added: Our Chief Operating Officer (“COO”) , who serves as our designated Chief Information Security officer (“CISO”), together with our Manager of Technology, has primary responsibility for the ongoing management of our cybersecurity program.
+Added: The COO meets regularly with the Manager of Technology to review information technology and security updates, including the results of periodic third-party cybersecurity penetration testing and proposed network security enhancements.
+Added: In the event of a cybersecurity incident, we maintain a defined incident response plan designed to facilitate timely response and mitigation.
+Added: The plan outlines immediate actions to address and contain potential impacts, as well as longer-term remediation measures and strategies intended to reduce the risk of future incidents.
+Added: Our COO has more than 30 years of experience in public company operations, including responsibilities that require oversight of information security as part of the effective performance of his duties.
+Added: He holds a Bachelor’s degree in Business Administration from Arizona State University.
+Added: Our Manager of Technology has served in various roles in information technology and information security for over 10 years.
+Added: He holds a Bachelor’s degree in Information Technology.
Our principal executive offices are located in Scottsdale, Arizona, where we own our headquarters office building.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.