19 unchanged sentences
Our board of directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face.
−Removed: Our board of directors administers its cybersecurity risk oversight function through the audit committee.
+Added: Our board of directors administers its cybersecurity risk oversight function through the audit committee and maintains a formal Incident Response Plan that is reviewed on an annual basis.
Our General Counsel and our management committee on cybersecurity, which includes IT, Finance, Communications and Human Resource management, are primarily responsible to assess and manage our material risks from cybersecurity threats.
−Removed: Our Senior Director of IT , who is part of our management committee on cybersecurity, has been managing our cybersecurity for the last 7 years and has been certified in cybersecurity through the International Information System Security Certification Consortium.
+Added: Our Vice President, Information Technology and Information Security , who is part of our management committee on cybersecurity, has been leading biopharmaceutical IT security teams for the last 10 years and IT teams for the last 20 years.
+Added: Additionally, our Senior Director of Information Technology, who is also part of the management committee on cybersecurity, has been managing our cybersecurity for the last 8 years and has been certified in cybersecurity through the International Information System Security Certification Consortium.
Our General Counsel and our management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in “Risk Management and Strategy” above.
−Removed: The processes by which our General Counsel and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include the participation of our Senior Director of IT in the management committee on cybersecurity, as well as the following:
+Added: The processes by which our General Counsel and our management committee on cybersecurity are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents include the participation of our Vice President, Information Technology and Information Systems in the management committee on cybersecurity, as well as the following:
● Prevention – management routinely takes steps to monitor compliance of our employees and third parties with the Company’s cybersecurity policies and processes.
−Removed: ● Detection - reports of potential cybersecurity incidents can come from various sources, including users, system operators, employees, or third parties that have noticed unusual or suspicious behavior in a system, network, or
−Removed: other operations processes.
+Added: ● Detection - reports of potential cybersecurity incidents can come from various sources, including users, system operators, employees, or third parties that have noticed unusual or suspicious behavior in a system, network, or other operations processes.
Employees, third parties, or authorities may report a potential incident via a telephone call, email, or other method to the organization.
2 unchanged sentences
● Remediation - remediation involves providing the technical support that is necessary to update software, repair hardware, and otherwise move our information systems toward recovery, as applicable.
−Removed: Our General Counsel and Chief Financial Officer provide quarterly briefings to the audit committee regarding our company’s cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.
+Added: Our Vice President, Information Technology and Information Systems provides quarterly briefings to the audit committee regarding our company’s cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the like.
Our audit committee provides regular updates to the board of directors on such reports.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.