3 unchanged sentences
We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our overall enterprise risk management processes.
−Removed: The processes for assessing, identifying and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers, include identifying the relevant assets that could be affected, determining possible threat sources and threat events, assessing threats based on their potential likelihood and impact, and identifying controls that are in place or necessary to manage and/or mitigate such risks.
+Added: The processes for assessing, identifying and managing material risks from cybersecurity threats, including threats associated with our use of third-party service providers and those that leverage artificial intelligence, include identifying the relevant assets that could be affected, determining possible threat sources and threat events, assessing threats based on their potential likelihood and impact, and identifying controls that are in place or necessary to manage and/or mitigate such risks.
We have established cybersecurity and privacy programs to maintain the confidentiality, integrity, availability, and privacy of protected information and ensure compliance with relevant security/privacy regulations, contractual requirements, and industry-standard frameworks.
Our cybersecurity program includes annual review and assessment by external, independent third parties, who certify and report on these programs.
−Removed: For example, our Information Security Management System (ISMS) is certified as being in conformity with ISO/IEC 27001 by SRI Quality System Registrar.
+Added: For example, our Information Security Management System (ISMS) is certified as being in conformity with ISO/IEC 27001 by PRI Certification.
We maintain cybersecurity and privacy policies and procedures in accordance with industry-standard control frameworks and applicable regulations, laws, and standards.
11 unchanged sentences
The technology integration and cloud-based depository platforms we continue to focus on can make us more vulnerable to cybersecurity threats, thereby making our pursuit of such strategies more costly.
−Removed: Our Board of Directors is responsible for exercising oversight of management’s identification and management of, and planning for, risks from cybersecurity threats.
+Added: Our Board of Directors, or the Board, is responsible for exercising oversight of management’s identification and management of, and planning for, risks from cybersecurity threats.
While the full Board has overall responsibility for risk oversight, the Board has delegated oversight responsibility related to risks from cybersecurity threats to the Board’s Technology Committee.
6 unchanged sentences
Members of the Cybersecurity and Privacy Committee have broad ranges of expertise and experience in information technology and security.
−Removed: Our ISO, a co-chair of the committee, has over fifteen years of experience in the field of information security management, having previously led security operations and infrastructure and IT functions for a public university campus and a non-profit organization, and holds several licenses and certifications relating to information security, including a Certified Information Systems Security Manager from the Information Systems Audit and Control Association (ISACA), a Certified Information Systems Security Professional (CISSP) from the International Information Security System Security Certification Consortium (ISC2) and several technical cybersecurity certifications from the Global Information Assurance Certification (GIAC).
+Added: Our ISO, a co-chair of the committee, has over fifteen years of experience in the field of information security management, having previously led security operations and infrastructure and IT functions for a public university campus and a non-profit organization, and holds several licenses and certifications relating to information security, including a Certified Information Systems Security Manager (CISM) from the Information Systems Audit and Control Association (ISACA), a Certified Information Systems Security Professional (CISSP) from the International Information Security System Security Certification Consortium (ISC2) and several technical cybersecurity Global Information Assurance Certification (GIAC) from the SANS Institute.
Our PSO, also a co-chair of the committee, has over twenty-five years of previous experience in cyber security architecture and cyber security management for a number of large Fortune 500 technology companies and holds several certifications including CISSP from the International Information Security System Security Certification Consortium, C-CISO from EC-Council, Numerous certifications from Microsoft, CISCO, Juniper, Checkpoint among others and has completed several advanced GIAC security classes from the SANS Institute.
13 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.