2 unchanged sentences
The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of its critical systems and information .
+Added: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).
+Added: Accordingly, we use NIST CSF as a
+Added: guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
The Company’s cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational and financial risk areas.
1 unchanged sentence
The Company’s technology management team is principally responsible for managing the Company’s cybersecurity risk assessment and management processes.
−Removed: The Company’s technology management team performs enterprise-level risk assessments designed to help identify
−Removed: material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment.
+Added: The Company’s technology management team conducts risk assessments designed to help identify material cybersecurity risks to our critical systems and information.
The Company’s technology management team and third-party professionals perform penetration tests, vulnerability scans, and patch management to assess and protect the confidentiality, integrity and availability of its critical systems and information.
−Removed: The Company provides training to its employees on cybersecurity matters, performs periodic awareness testing to facilitate compliance with the Company’s cybersecurity policies, and maintains a method for its employees and consultants to communicate any suspected cybersecurity incident.
+Added: The Company's risk assessment and management processes also address emerging cybersecurity threats, including those that are AI-enabled.
+Added: The Company provides training to its employees on cybersecurity matters, conducts periodic tabletop incident response exercises, performs recurring awareness testing to facilitate compliance with the Company’s cybersecurity policies, and maintains a method for its employees and consultants to communicate any suspected cybersecurity incident.
+Added: Furthermore, the Company has adopted internal guidelines designed to address employee use of third-party artificial intelligence tools and protect confidential Company information from unauthorized disclosure to such tools.
In addition, the Company evaluates key third-party service providers before the Company grants the service provider access to its information systems and has a process in place to ensure that future access is appropriate.
12 unchanged sentences
The CTO oversees the Company’s initiatives to address existing or evolving cyber risks and is a member of the Enterprise Risk Committee.
−Removed: The CTO reports to the Chief Executive Officer (“CEO”) and provides updates to the Company’s senior leadership team on a regular basis, at least quarterly, about risks from cybersecurity threats, the results of penetration tests, vulnerability scans and userbase issues.
−Removed: The CTO and other members of the Company’s management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, such as briefings from internal security personnel;
+Added: The CTO reports to the Chief Executive Officer and provides updates to the Company’s senior leadership team on a regular basis, at least quarterly, about risks from cybersecurity threats, the results of penetration tests, vulnerability scans and userbase issues.
+Added: The CTO and other members of the Company’s management team take steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, such as briefings from internal security personnel;
threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged;
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.