4 unchanged sentences
We have established policies and processes for assessing, identifying, and managing risk from cybersecurity threats and have integrated these processes into our overall risk management systems and processes.
−Removed: We are subject to various federal and state privacy and security laws, regulations, and requirements.
−Removed: These laws govern the collection, use, disclosure, protection, and maintenance of the individually identifiable information that we collect from consumers.
−Removed: We regularly assess our compliance with privacy and security requirements and conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems that are vulnerable to such cybersecurity threats.
+Added: We are subject to various federal and state privacy and security laws, regulations, and requirements that govern the collection, use, disclosure, protection, and maintenance of the individually identifiable information that we collect from consumers.
+Added: We regularly assess our compliance with privacy and security requirements and conduct periodic risk assessments to identify cybersecurity threats, as well as assessments in the event of a material change in our business practices that may affect information systems vulnerable to such threats.
Early on, we identified information security as a salient risk as described in Part I, Item 1A, Risk Factors , of this Annual Report on Form 10-K.
We maintain data privacy and security through a robust program of safeguards, including responsible management, appropriate use, and protection that is designed to address applicable legal and regulatory requirements.
−Removed: Furthermore, all employees are required to complete annual privacy and security training.
−Removed: Our security policies and procedures are reviewed and updated regularly to address regulatory, industry, and contractual requirements and recommendations and address new and emerging security threats.
−Removed: We also conduct regular scans of our technical infrastructure and regular penetration audits to check for vulnerabilities and meet our governance and compliance requirements.
+Added: Our security policies and procedures are reviewed and updated regularly to address regulatory, industry, and contractual requirements and recommendations and to address new and emerging security threats.
+Added: We also conduct regular scans of our technical infrastructure and regular penetration tests to check for vulnerabilities.
Training our employees and contractors is crucial to eHealth’s governance and compliance requirements.
All employees and contractors with access to an eHealth IT system are required to complete security awareness training during onboarding and annually thereafter.
−Removed: Due to the increased inherent risk associated with these roles, developers and privileged users are subject to additional security training requirements.
+Added: Developers and privileged users are subject to additional security training requirements due to the increased inherent risk associated with these roles.
Every person with access to eHealth IT systems is required to undergo periodic phishing simulations and receives personalized tools to improve their security behavior.
Performance is measured both individually and by functional groups to manage the maturity and improvement of eHealth’s overall security posture.
−Removed: Employees must also acknowledge receipt and understanding of their responsibility to comply with eHealth’s Code of Business Conduct, including the eHealth Information Security and Acceptable Use Policies, during onboarding and annually thereafter.
−Removed: Despite our rigorous efforts, incidents may occur, and we are prepared to deal with them through our formal Incident Response Plan.
+Added: Employees must also acknowledge receipt and understanding of their responsibility to comply with eHealth’s Code of Business Conduct and Ethics, Information Security Policy and Acceptable Use Policy, during onboarding and annually thereafter.
+Added: Despite our rigorous efforts, incidents may occur, and eHealth has created a formal Incident Response Plan.
Events such as human errors, computer viruses or other malicious code, unauthorized access, cyber-attacks, or phishing attempts concern all organizations.
Our Incident Response Team is trained to contain incidents, mitigate impacts, resolve or remediate issues, and notify affected parties as appropriate.
−Removed: The team is made up of key security, privacy, and legal professionals who work with eHealth Technology and Business Teams and our managed security services.
−Removed: Additionally, eHealth has engaged a guided cyber crisis response platform and conducted a mock cyber-attack exercise to build crisis management experience for our senior leadership and cybersecurity teams.
−Removed: We believe this voluntary skill building exercise put our teams in a better position to manage a potential cybersecurity crisis.
−Removed: Our comprehensive data security strategy includes:
+Added: The Incident Response team is comprised of key security, privacy, and legal professionals within the eHealth organization as well as other managed security service providers.
+Added: Additionally, eHealth has engaged a guided cyber crisis response platform and conducts at least annually a mock cyber-attack exercise to build crisis management experience for our senior leadership team, key functional leaders and the Incident Response Team.
+Added: We believe this proactive exercise puts eHealth in a better position to manage a potential cybersecurity crisis.
+Added: Our data security strategy includes:
• Regular critical security assessments such as advanced attack simulations and vulnerability scans.
6 unchanged sentences
• A broad spectrum of technical controls, including data loss prevention, role-based access, application/desktop logging, and data encryption as well as multi-factor authentication and enhanced web application firewall controls.
−Removed: We, like any technology company, have experienced cybersecurity incidents in the past.
−Removed: However, as of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity incidents that have been determined to be material.
+Added: As of the date of this Annual Report on Form 10-K, we have not experienced any cybersecurity incidents that have been determined to be material.
For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our company, including our business, operating results and financial condition, please refer to Part I, Item 1A, Risk Factors , of this Annual Report on Form 10-K.
2 unchanged sentences
The Board administers its cybersecurity risk oversight both directly and through its Audit Committee.
−Removed: The Audit Committee is regularly briefed on eHealth’s risk profile issues.
−Removed: These briefings are designed to provide visibility about identifying, assessing, and managing critical risks, audit findings, and management’s risk mitigation strategies.
+Added: The Audit Committee is regularly updated on eHealth’s cybersecurity posture and cyber risk profile.
Management briefs the Audit Committee periodically about eHealth’s protection programs, focusing on current trends in the environment, incident preparedness, business continuity management, program governance, and program components, including updates on security processes, external testing, and employee training and awareness initiatives.
−Removed: eHealth’s Head of Information Security reports to our Chief Digital Officer (“CDO”) and, with respect to cybersecurity risks, to the Audit Committee of the Board of Directors.
+Added: The Audit Committee discusses with Company management critical risks and audit findings and provides oversight with respect to risk mitigation strategies.
+Added: Our Head of Information Security reports to our Chief Digital & AI Officer (“CDO”) and, with respect to cybersecurity risks, to the Audit Committee.
Our Head of Information Security focuses on information and systems technology, corporate governance, and behaviors to drive security best practices and safeguard information from unauthorized or inappropriate access, use, or disclosure.
4 unchanged sentences
Before that, our Head of Information Security was Senior Manager of Cyber Security at Secureworks.
−Removed: His security experience also includes a 12-year career at Banc of America Securities and subsequently at Merrill Lynch on their information security teams as Senior Consultant, Systems Engineering & Architecture.
+Added: His security experience also includes a 12-year career at Banc of America Securities and subsequently at Merrill Lynch on their information
+Added: security teams as Senior Consultant, Systems Engineering & Architecture.
Our CDO joined eHealth in 2023 and was previously Chief Product Officer at M1 Finance, responsible for defining the company’s product vision, strategy and roadmap to drive growth and profitability, Prior to M1 Finance, our CDO was the Chief Product Officer at Roofstock, Head of Product at LifeLock (acquired by Symantec) and Sr.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.