10 unchanged sentences
We assess and identify security risk to the organization by:
−Removed: • conducting assessments of risk including likelihood and magnitude from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored, or transmitted.
−Removed: • performing risk assessments and producing security assessment reports that document the results of the assessment for use and review by information technology (IT) senior leadership, including the Service Center's Chief Information Officer.
+Added: • conducting risk assessments to determine the likelihood and magnitude of an attack from unauthorized access, use, disclosure, disruption, modification or destruction of information systems and the related information processes, stored, or transmitted;
+Added: • performing penetration testing assessments annually and producing security assessment reports that document the results of the assessment for use and review by information technology (IT) senior leadership, including the Service Center's Chief Information Officer;
• ensuring security controls are assessed for effectiveness, are implemented correctly, operating as intended and producing the desired outcome;
−Removed: • continuously scanning for vulnerabilities and remedying all vulnerabilities in accordance with the associated risk.
+Added: • continuously scanning for vulnerabilities and remediating vulnerabilities within their service level agreements in accordance with the associated risk level;
+Added: • reviewing third party and vendor risks to our organization through an internal interdisciplinary Technology Advisory Committee that includes members from our IT, Information Security Office (ISO), legal, compliance, clinical, finance and billing departments.
We have established a continuous monitoring strategy and program, which includes:
2 unchanged sentences
• addressing results of analysis and reporting security status to the executive team;
−Removed: • monitoring information systems to detect attacks and indicators of potential attacks.
+Added: • monitoring information systems to detect attacks and indicators of potential attacks or compromises;
• identification of unauthorized use of the information system resources;
−Removed: • deployment of monitoring devices strategically within the information system environment.
+Added: • deployment of monitoring systems and agents strategically within the information system environment;
+Added: • require that third party service providers who store, process or transmit data with access to electronic Protected Health Information (ePHI) undergo an independent third-party audit to achieve system organization controls certification annually.
Data Protection
−Removed: We have implemented an Information Security Management System (ISMS) Program to secure sensitive data protected by us.
+Added: We have implemented an Information Security Management System Program to secure sensitive data protected by us.
This program includes:
7 unchanged sentences
Our cybersecurity incident management plan comprises the following six-step process:
−Removed: • The Service Center's Chief Information Officer and Director of Information Security lead its Information Security Office (ISO) team in the development, documentation, review and testing of security procedures and incident management procedures.
+Added: • The Service Center's Chief Information Officer and Director of Information Security lead its ISO team in the development, documentation, review and testing of security procedures and incident management procedures.
Beyond initial creation, procedures are continually re-assessed, updated and tested on an ongoing basis.
−Removed: • The Service Center's Chief Information Officer and Director of Information Security work with the Executive Team on the identification, assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact.
+Added: • The ISO team works with the Executive Team on the identification, assessment, verification and classification of incidents to determine affected stakeholders and appropriate parties for contact.
• The Service Center's Chief Information Officer and Director of Information Security are responsible for launching the Incident Response Team (IRT) if necessary and for notification to the Executive Team, who in turn will contact the Board of Directors and the Audit Committee to validate that the response is being addressed appropriately.
10 unchanged sentences
We have not experienced a material cybersecurity breach in the past five years and, as a result, there have been no charges related to a breach in the past five years.
−Removed: Moreover, no risks from cybersecurity threats have materially affected our business strategy, results of operations, or financial condition.
+Added: Moreover, risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition.
While we have implemented processes and procedures that we believe are tailored to address and mitigate the cybersecurity threats that our company faces, there can be no assurances that such an incident will not occur despite our efforts, as more fully described in Item 1A.
4 unchanged sentences
Like many organizations, we align to a Cyber Security Framework and take a risk-based approach during control assessment and implementation.
−Removed: We align to the National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4, a globally recognized cyber security framework of Policies, Standards and Controls that comprises of five categories of defense – Identify, Protect, Detect, Respond and Recover.
+Added: We align to the National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 4, a globally recognized cyber security framework of Policies, Standards and Controls is comprised of five categories of defense – Identify, Protect, Detect, Respond and Recover.
We are committed to the protection of our data, systems, network and continually invest in enhancements to mitigate or reduce the impact from a cyber security threat.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.