1 unchanged sentence
Cybersecurity
−Removed: We maintain a comprehensive information and cybersecurity and data privacy program to safeguard the security, confidentiality, integrity, availability and protection of the Company’s and our clients’ information.
−Removed: We aim to continually strengthen our cybersecurity posture and protocols.
−Removed: We have invested in people, processes and technology intended to protect information throughout the business life cycle and to manage cybersecurity risk, and we intend to continue to do so as cybersecurity risks and methods for preventing against them evolve.
−Removed: We provide no assurance that the policies and procedures outlined below will be properly followed in every instance or that they will be effective in safeguarding against every possible cybersecurity threat.
−Removed: We describe how cybersecurity threats are likely to materially affect our business, results of operations, and financial conditions in Part I, Item 1A, “Risk Factors.
−Removed: ” We believe that these risks have not materially affected our business to date, but we can provide no assurance that they will not affect us in the future.
−Removed: Although we maintain cybersecurity insurance to manage potential liabilities resulting from specific cybersecurity incidents, there is no guarantee that our insurance coverage limits will protect against any future claims or that such insurance proceeds will be paid to us in a timely manne r .
−Removed: See “Risks Related to Our Business-Unauthorized disclosure of sensitive or confidential client and employee data, whether through breach of our computer systems or otherwise, could cause us significant reputational damage, expose us to protracted and costly litigation, and cause us to lose clients.”
+Added: We maintain a comprehensive cybersecurity and data privacy program to safeguard the security, confidentiality, integrity, availability and protection of the Company’s and our clients’ information.
+Added: Cyber security is also an inherent consideration for our data and AI-led solutions.
+Added: Specifically, there is a heightened focus on institutionalizing a Responsible AI framework to proactively identify and mitigate data protection and privacy risks.
+Added: We aim to continually strengthen our cybersecurity posture and protocols by investing in people, processes and technology intended to protect information throughout the business life cycle and to manage cybersecurity risk, and we intend to continue to do so as cybersecurity risks and methods for preventing against them evolve.
+Added: No assurance can be given that the policies and procedures outlined below will be properly followed in every instance or that they will be effective in safeguarding against every possible cybersecurity threat.
+Added: We describe how cybersecurity threats are likely to materially affect our business, results of operations, and financial conditions in Part I, Item 1A, “Risk Factors” under “Risks Related to Our Business–– Unauthorized disclosure of sensitive or confidential client and employee data, whether through breach of our computer systems or otherwise, could cause us significant reputational damage, expose us to protracted and costly litigation, and cause us to lose clients.” We believe that these risks have not materially affected our business to date, but we can provide no assurance that they will not affect us in the future.
+Added: Although we maintain cybersecurity insurance to mitigate potential liabilities resulting from specific cybersecurity incidents, there is no guarantee that our insurance coverage limits will comprehensively protect us against any future claims or that such insurance proceeds will be paid to us in a timely manne r .
Cybersecurity Strategy and Risk Management
2 unchanged sentences
We have undertaken measures designed to comply with applicable privacy laws and regulations that are applicable to our services.
−Removed: These security capabilities are designed to mitigate material vulnerabilities and the impact of cyber incidents.
−Removed: We regularly conduct cybersecurity and other risk assessments and compliance audits both internally and through third party auditors that we independently engage or that we engage in connection with our certification to certain international standards, such as the ISO 27001:2013 standard for information security management systems, the ISO 22301:2012 for business continuity management systems, the ISO 9001:2008 standard for quality management systems, among others.
−Removed: regularly assess and deploy technical safeguards and conduct vulnerability assessment and penetration testing of our technology environment independently and through third parties.
+Added: These security capabilities are designed to mitigate vulnerabilities and the impact of cyber incidents.
+Added: Cyber security is an inherent consideration for our data and AI-led digital solutions.
+Added: There is heightened focus on institutionalizing a Responsible AI framework that includes periodic Secure AI assessments to proactively identify and mitigate data protection and privacy risks.
+Added: We regularly conduct cybersecurity and other risk assessments and compliance audits both internally and through third party auditors that we independently engage or that we engage in connection with our certification to certain international standards, such as the ISO 27001:2013 standard for information security management systems, PCI DSS for handling financial data, the ISO 22301:2012 for business continuity management systems, the ISO 9001:2008 standard for quality management systems, SOC 1 TYPE II and SOC 2 TYPE II, among others.
+Added: We also regularly assess and deploy technical safeguards and conduct vulnerability assessment and penetration testing of our technology environment independently and through third parties.
We use the outcome of these assessments to align our cybersecurity program and technical safeguards with the evolving cybersecurity threat landscape and adjust and augment our security controls environment as required.
We have implemented a third-party risk management program to proactively identify and mitigate any potential risks that emerge from our supplier and partner ecosystem.
−Removed: There are processes in place to restrict and provide need-based access to sensitive or confidential data for third parties.
−Removed: We conduct periodic evaluations of key suppliers and partners for ongoing monitoring of the risk environment.
+Added: We have processes in place to restrict and provide need-based access to sensitive or confidential data for third parties.
+Added: Additionally, we conduct periodic evaluations of key suppliers and partners for ongoing monitoring of the risk environment.
Incident Response and Recovery Planning
3 unchanged sentences
Further, we have empaneled specialized cyber partners to provide advanced investigation capabilities and response management support in case of a real cyber incident.
+Added: Periodic tabletop and crisis simulation exercises are conducted to reinforce our incident response controls on an ongoing basis.
Training and Awareness
8 unchanged sentences
Annually, our board of directors receives a report from management on our cybersecurity posture, our readiness and our capability to reduce the risk of, detect and respond to a cyberattack.
−Removed: In 2022 and 2023, our senior management and board of directors completed cyber tabletop exercises to further enhance our preparedness in the event of an actual incident.
+Added: Our senior management and board of directors participate in periodic cyber tabletop exercises to further enhance our preparedness in the event of an actual incident.
+Added: The Cyber Security program including security operations, governance, risk and compliance, data privacy, and business continuity is led by our Chief Information Security Officer (“CISO”) who has over 25 years of extensive experience in technology and data center architecture, client solutioning, complex program management and nearly a decade in cyber risk management, governance and incident handling.
+Added: Our CISO is supported by a team of cyber experts, many of whom are certified professionals in areas of security architecture, threat hunting, incident response, application security, business resiliency and data privacy among others.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.