4 unchanged sentences
These risks include, among other things:
−Removed: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.
+Added: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws as well as overall business continuation risk.
Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes.
2 unchanged sentences
conduct proactive privacy and cybersecurity reviews of systems and applications, conduct employee training, monitor emerging laws and regulations related to data protection and information security and implement appropriate changes.
+Added: We also engage third-party cybersecurity consultants to help us oversee cybersecurity threats both internally and in relation to our third-party service providers, including in connection with the foregoing activities.
+Added: Our third-party cybersecurity consultants work to mitigate cybersecurity risks by executing all-inclusive security procedures, including but not limited to continuous employee education and training, assessing risks, monitoring systems, implementing security controls, and responding to incidents.
+Added: This is done in a variety of manners including assessing the strength of outside vendors, suppliers and business partners that may have access to the Company’s data and systems, setting up strong access controls in the form of firewalls and encryption, continuous monitoring of data for suspicious activity and other threats, security audits and extensive training.
We have implemented a cybersecurity risk management program that leverages the National Institute of Standards and Technology (“NIST”) framework, which organizes cybersecurity risks into five categories:
4 unchanged sentences
Our risk management program also assesses third-party cybersecurity risks and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers .
−Removed: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading “ Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties’ cybersecurity ” in our risk factor disclosures in Item IA of this Annual Report on Form 10-K.
+Added: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition , under the heading “ Our business and operations would suffer in the event of computer system failures, cyber-attacks, or deficiencies in our or third parties’ cybersecurity ” in our risk factor disclosures in Item 1A of this Annual Report on Form 10-K.
Cybersecurity Governance
Cybersecurity is an important part of our risk management processes and an area of focus for our management.
+Added: Our Chief Financial Officer (“CFO”) oversees the leaders from our information security, compliance and legal teams who are responsible for our cybersecurity risk management and strategy processes.
+Added: Our CFO, together with these individuals, also oversee the work of our third-party consultants.
+Added: These individuals have significant prior business experience in compliance and risk management.
+Added: Specifically, our CFO has more than 25 years of experience in all aspects of corporate controllership including managing operating and organizational risk developing, executing and maintaining robust internal control environments, including cybersecurity risk and cash controls as part of several pharmaceutical company operations.
+Added: Our CFO, as well as our management team, are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to our audit committee and overall board of directors on any appropriate items.
Our executive management is responsible for the oversight of risks from cybersecurity threats.
−Removed: Members of our board of directors receive updates from our executive management team regarding matters of cybersecurity.
+Added: Members of our board of directors receive periodic updates from our executive management team regarding matters of cybersecurity.
This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.
−Removed: Our cybersecurity risk management and strategy processes are overseen by leaders from our information security, compliance and legal teams.
−Removed: These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to our board of directors on any appropriate items.
+Added: Any urgent cybersecurity threats are immediately flagged and reported to the board of directors .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.