6 unchanged sentences
This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
−Removed: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
+Added: Our cybersecurity risk management program incorporates methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
Our cybersecurity risk management program includes:
−Removed: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;
+Added: • vendor and system security risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;
• a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
11 unchanged sentences
The full Board also receives briefings from management on our cyber risk management program.
−Removed: Board members receive presentations on relevant cybersecurity topics from our Senior Vice President of Security Operations and internal security staff.
−Removed: Our management team, including our Chief Information Security Officer (CISO)/Senior Vice President of Information Technology and Security (SVP), is responsible for assessing and managing, and mitigating cyber risk and security threats.
+Added: Board members receive presentations on relevant cybersecurity topics from our Chief Information Security Officer (“CISO”) and internal security staff.
+Added: Our CISO is primarily responsible for assessing and managing, and mitigating cyber risk and security threats.
The Security team has primary responsibility for our overall cybersecurity risk management program and supervises both internal cybersecurity personnel and external cybersecurity consultants and contractors.
The Security team members have diverse experience in security strategy, architecture, and operations.
−Removed: Additionally, the CISO/SVP has more than 30 years’ experience leading transformative security and technology.
−Removed: The CISO/SVP has earned the following certifications:
−Removed: Certified Information Systems Manager, Department of Homeland Security, Certified Incident Command, Certified Technical Emergency Response Training, Certified Incident Response, and the penetration testing team leader holds Offensive Security Certified Professional and Certified Red Team Operator certifications and the additional Security Operations team members hold a Security + certification .
+Added: Additionally, the CISO has more than 30 years’ experience leading transformative security and technology.
+Added: The CISO has earned the following certifications:
+Added: Certified Information Systems Manager, Department of Homeland Security, Certified Incident Command, Certified Technical Emergency Response Training, Certified Incident Response.
+Added: Our Director, Information Security leads the penetration testing team and holds Offensive Security Certified Professional, Certified Ethical Hacker, Offensive Security Wireless Professional, and Certified Red Team Operator certifications .
Our Security Operations team, in coordination with our legal and compliance teams, supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel;
2 unchanged sentences
Our Security Operations team meets monthly with key executives and management to provide updates regarding the Company’s cybersecurity efforts.
−Removed: For more information, see the section titled “Risk Factor— Unauthorized disclosure, destruction or modification of data, disruption of our software or services or cyber breaches could expose us to liability, protracted and costly litigation and damage our reputation.”
+Added: For more information, see the section titled “Risk Factor— We and our third-party providers are exposed to cybersecurity risks and incidents which may result in damage to our brand and reputation, material financial penalties, and legal liability, which could in turn materially adversely affect our business, results of operations, and financial condition.”
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.