10 unchanged sentences
and regularly monitor the effectiveness of our safeguards.
−Removed: We devote significant resources and designate high-level personnel, including our Head of IT and Cybersecurity, to manage the risk assessment and mitigation process.
+Added: We devote significant resources and designate high-level personnel, including our Vice President of Information Technology and Cybersecurity (" VP of IT") , to manage the risk assessment and mitigation process.
As part of our overall risk management system, we conduct annual security awareness training for personnel at all levels and functions, issue periodic simulated social engineering tests, and have established protocols to escalate cybersecurity incidents from identification through remediation.
7 unchanged sentences
Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.
−Removed: Our Head of IT is primarily responsible to assess and manage our material risks from cybersecurity threats and has prior work experience in cybersecurity, holds relevant degrees, and has current industry recognized cybersecurity certifications.
−Removed: Our Head of IT oversees our cybersecurity policies and processes, including those described in “Risk Management and Strategy” above.
−Removed: The processes by which our Head of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following:
+Added: Our VP of IT is primarily responsible for assessing and managing our material risks from cybersecurity threats.
+Added: He has prior work experience in cybersecurity, holds relevant degrees, and has current industry-recognized cybersecurity certifications.
+Added: He oversees our cybersecurity policies and processes, including those described in “Risk Management and Strategy” above.
+Added: The processes by which the VP of IT is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents include the following:
the identification and assessment of assets and assessing potential associated risks, implementation of protective measures, continuous monitoring and detection of unusual or suspicious activities, incident response and recovery management, regular security awareness and training, and review and alignment of cybersecurity practices with industry recognized cybersecurity practices, compliance, and regulation concerns.
−Removed: Our Head of IT provides quarterly briefings to the audit committee regarding our company’s cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.
−Removed: Our audit committee provides regular updates to the board of directors on such reports;
−Removed: the Head of IT may be called upon to brief the board as well.
+Added: The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk.
+Added: The A udit Committee receives quarterly updates from the VP of IT regarding our company’s cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and cyberinsurance coverage;
+Added: the Audit Committee in turn provides regular updates to the B oard of Directors .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.