2 unchanged sentences
Risk management and strategy
−Removed: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, trade secrets, personal information, and data of our customers (including their end-users) (“Information Systems and Data”).
+Added: We have implemented and maintain various cybersecurity processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, trade secrets, personal information, and data of our customers (including their end-users) (“Information Systems and Data”).
Our Chief Information Security Officer (“CISO”) and security organization help identify, assess, and manage the Company’s cybersecurity threats and risks, including through the use of the Company’s security risk register.
7 unchanged sentences
vulnerability management policy;
−Removed: disaster recovery plans;
+Added: business continuity plan;
risk assessments;
23 unchanged sentences
We use third-party service providers to perform a variety of functions throughout our business, such as providing cloud-based infrastructure, hosting third party applications, and delivering content to customers, as well as data center hosting.
−Removed: We have a formal vendor management program to manage cybersecurity risks associated with our use of these providers.
−Removed: The security organization conducts a risk assessment to determine the criticality of the vendor prior to onboarding.
−Removed: Depending on the criticality of the vendor–which is based on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider–our vendor security review process involves different levels of assessment designed to identify cybersecurity risks associated with a provider prior to onboarding and on a periodic basis, including, for example:
+Added: We have a formal vendor management program designed to manage cybersecurity risks associated with our use of these providers.
+Added: The procurement organization conducts an initial risk assessment to determine the criticality of the vendor prior to onboarding.
+Added: Depending on the criticality of the vendor–which is based on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider–our security organization conducts our vendor security review process, which involves different levels of assessment designed to identify cybersecurity risks associated with a provider prior to onboarding and on a periodic basis, including, for example:
(1) a vendor security questionnaire;
2 unchanged sentences
Based on the results of the vendor security review, a decision is made on whether the third-party can be engaged.
−Removed: We review our most critical providers' audit reports and certifications on an annual basis to reassess whether or not they have experienced any material changes or degradations to their security programs since our initial
−Removed: review that may warrant re-evaluation.
−Removed: The Company generally engages reputable third-party service providers and when appropriate, imposes contractual obligations related to cybersecurity on its providers.
+Added: We review our most critical providers' audit reports and certifications on a regular basis to reassess whether or not they have experienced any material changes or degradations to their security programs since our initial review that may warrant re-evaluation.
+Added: generally attempts to engage reputable third-party service providers and when appropriate, imposes contractual obligations related to cybersecurity on its providers.
+Added: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.
+Added: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1.
−Removed: Risk Factors in this Annual Report on Form 10-K, including “If our information technology systems or data, or those of third parties upon which we rely, are compromised now, or in the future, or the security, confidentiality, integrity or availability of our information technology, software, services, networks, communications or data is compromised, limited or fails, our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences.”
−Removed: Our board of directors addresses the Company’s cybersecurity risk management as part of its general oversight function.
+Added: Risk Factors in this Annual Report on Form 10-K , including “If we or our third-party providers fail to protect our IT Systems or Confidential Information, and/or experience a data security incident our business could experience materially adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, loss of revenue or profits, loss of customers or sales, reputational harm, and other adverse consequences.”
+Added: Our board of directors addresses the Company’s cybersecurity risk management as part of its general risk oversight function.
The board of directors is responsible for overseeing Company’s cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.
13 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.