2 unchanged sentences
Cybersecurity
+Added: Risk Management and Strategy
We have established certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology functions and are designed to help protect our information, assets and operations from internal and external cyber threats.
−Removed: Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices.
−Removed: We engage certain external parties , including consultants, independent privacy assessors, computer security firms and risk management and governance experts, as appropriate to enhance our cybersecurity oversight.
−Removed: We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect us from any related vulnerabilities.
+Added: Our cybersecurity risk management program is informed by recognized industry frameworks (e.g., NIST Cybersecurity Framework) which includes a risk assessment methodology designed to escalate cybersecurity risks to the appropriate channels within our organization to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise information technology (“IT”) environment.
+Added: The IT and legal departments help identify, assess and manage our cybersecurity threats and risks.
+Added: The IT department, in coordination with the legal department, identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods, including evaluating threats reported to us, conducting audits, performing threat assessments, conducting vulnerability assessments and penetration tests.
+Added: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our information systems and data, including an incident response plan that we periodically review and test to ensure it is well understood and the processes are being properly followed.
+Added: The incident response plan includes procedures for responding to cybersecurity incidents and escalating cybersecurity incidents to cross-functional teams, management and our Board of Directors.
+Added: Other controls include business continuity plans, encryption of data, network security controls, systems monitoring, mandatory annual employee training, and cybersecurity insurance.
+Added: Our assessment and management of material risks from cybersecurity threats are integrated into our risk management protocols.
+Added: Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas, including the involvement of cross-functional teams and, depending on the nature and severity of an incident, an escalation path to notify our executive and senior management teams and our Board of Directors.
+Added: Material cybersecurity incidents are escalated to the Audit Committee and, as appropriate, the Board of Directors.
+Added: We use third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including professional service firms, legal counsel, cybersecurity software providers and managed cybersecurity service providers.
+Added: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, hosting companies, contract research organizations, contract manufacturing organizations and supply chain resources.
+Added: Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment which may include security questionnaires, review of System and Organization Controls reports, contractual requirements, and
+Added: Table of Co ntents
+Added: periodic reassessments designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.
We do not believe that there are currently any risks from known cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.
For additional information regarding risks we face, please refer to Part I, Item 1A “Risk Factors—Risks Related to Employee Matters, Managing Growth, Public Health and Information Technology—Security breaches and other disruptions to our information technology structure could compromise our information, disrupt our business and expose us to liability, which would cause our business and reputation to suffer” of this Annual Report on Form 10-K.
+Added: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee of our Board oversight of cybersecurity and other information technology risks.
The Audit Committee of our Board of Directors oversees our cybersecurity and data privacy risk management activities, and reports to the Board regarding such oversight as appropriate.
−Removed: The Audit Committee receives updates from management regarding cybersecurity matters not less than twice per year, and is notified between such updates regarding any significant new cybersecurity threats or incidents.
−Removed: Our Head of Information Security leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes, and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks.
−Removed: The Head of Information Security has approximately 20 years of cybersecurity expertise, including more than 15 years working in information security with the U.S.
−Removed: Federal Reserve System, serving most recently as the Assistant Vice President for Operations and Information Security.
−Removed: He has received both a GIAC Security Leadership certificate and a Certified Information Systems Security Professional certification.
−Removed: We have also established a cross-functional Cybersecurity Incident Response Team led by our Head of Information Security serving as the chair and consisting of senior-level functional leaders, with appropriate members of our executive leadership team added on an ad hoc basis as necessary for any particular threat or incident.
−Removed: This team seeks to safeguard the confidentiality, integrity, and availability of our critical information assets and protect against cyber threats through establishing a proactive and effective incident response program, fostering a culture of security awareness, and ensuring the continuous improvement of our incident response capabilities.
−Removed: In the event of a cyber security incident, the team is responsible for the swift detection, containment, mitigation, and recovery from such incident to minimize business disruption, protect intellectual property, and maintain the trust of our stakeholders.
−Removed: In an effort to deter prevent and detect cyber threats, we provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers a range of timely and relevant topics.
−Removed: Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security.
−Removed: The training and compliance program functions to educate employees on the importance of reporting all incidents immediately.
−Removed: We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.
+Added: The Audit Committee receives updates from management, including our Head of IT, regarding cybersecurity matters not less than twice per year, and is notified between such updates regarding any significant new cybersecurity threats or incidents.
+Added: Our Head of IT , who reports to our Chief Technical and Quality Officer and is a member of our senior leadership team, has primary responsibility for day-to-day management of our cybersecurity risk management program, including leading a dedicated team of IT professionals to monitor and assess cybersecurity risks, and is responsible for strategic leadership of our cybersecurity risk management program.
+Added: The Head of IT role is currently held by an individual who has over 15 years of professional IT management experience in the life sciences industry.
+Added: The Head of IT collaborates closely and regularly with an external consulting firm that provides a fractional Chief Information Security Officer, who has over 25 years of experience, including in senior information technology and cybersecurity management positions.
+Added: Our Head of IT provides regular updates on our cybersecurity risk to our executive leadership team and other management responsible for IT and cybersecurity risk management.
We lease 59,783 square feet of office and laboratory space in Cambridge, Massachusetts under a lease that expires in October 2028.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.