4 unchanged sentences
operational risks, fraud, harm to employees or customers and violation of data privacy or security laws.
−Removed: These cybersecurity risks make it necessary that we expend extensive assets on cybersecurity.
+Added: These cybersecurity risks make it necessary that we incur significant expenditures on cybersecurity.
Cybersecurity Governance
−Removed: Our audit committee of our board of the directors is formally charged with oversight of cybersecurity risk.
−Removed: This includes r eviewing the Company’s cybersecurity and other information technology risks, controls and procedures, including high-level review of the threat landscape facing the Company and the Company’s strategy to mitigate cybersecurity risks and potential breaches, and the Company’s plan to respond to data breaches.
+Added: Our audit committee of our board of directors is formally charged with oversight of cybersecurity risk.
+Added: This includes r eviewing the Company’s cybersecurity and other information technology risks, controls and procedures, including a high-level review of the threat landscape facing the Company and the Company’s strategy to mitigate cybersecurity risks and potential breaches, and the Company’s plan to respond to data breaches.
Identifying and assessing our cybersecurity risk is integrated into our overall risk management systems and processes.
12 unchanged sentences
reconnaissance, intrusion, exploitation, privilege escalation, lateral movement, obfuscation/anti-forensics, denial of service and exfiltration.
−Removed: Along with this model, we engage and utilize various third parties to measure risk profiles of ourselves and vendors, security threats specific to our Company both internal and external through multiple avenues such as website and social media and perform periodic penetration tests to identify cybersecurity risks and threats to the Company.
+Added: Along with this model, we engage and utilize various third parties to measure risk profiles of ourselves and vendors, security threats specific to our Company both internal and external through multiple avenues such as our website and social media and perform periodic penetration tests on Company systems to identify cybersecurity risks and threats to the Company.
These evaluations include testing both the design and operational effectiveness of security controls.
1 unchanged sentence
We assess third party cybersecurity controls as part of our third-party information technology risk when integrating new tools or third parties.
−Removed: We contractually require third parties to report cybersecurity incidents to us so we can assess the impact of the incident and any necessary regulatory reporting obligations that may be required.
+Added: We contractually require third parties to report cybersecurity incidents, if applicable, to us so we can assess the impact of the incident and any necessary regulatory reporting obligations that may be required.
Additionally, as part of the contract management process, new information technology vendors are subject to a cybersecurity review by the information technology team and include cybersecurity and data privacy language, if applicable, in contracts.
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.