Unresolved Staff Comments.
−Removed: Table o f Contents
Cybersecurity
Cybersecurity Risk Management and Strategy
−Removed: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.
+Added: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and data .
We design and assess our program based on the International Organization for Standardization (“ISO”) 27001 framework and other applicable industry standards.
−Removed: This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such standards, including the ISO 27001 Framework, as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
+Added: This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use such standards, including ISO 27001, as a guide to help us identify, detect, assess, and manage reasonably foreseeable cybersecurity risks and threats relevant to our business.
Our cybersecurity risk management program is supported by both management and our Board of Directors, and is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.
−Removed: Our cybersecurity risk management program includes:
−Removed: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment, which are then used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our management team and Audit Committee on a quarterly basis;
+Added: Key elements of our cybersecurity risk management program include, but are not limited to the following:
+Added: • risk assessments designed to help identify reasonably foreseeable material risks from cybersecurity threats to our critical systems, information, products, services, and our broader enterprise IT environment, which are then used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our management team and Audit Committee on a quarterly basis;
• a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
−Removed: • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;
−Removed: • periodic assessment and deployment of security tools and technical safeguards designed to protect our information systems from cybersecurity threats;
+Added: • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes;
+Added: • periodic assessment and deployment of security tools and technical safeguards designed to protect our information systems from reasonably foreseeable cybersecurity threats;
• cybersecurity awareness training of our employees, incident response personnel, and senior management;
• a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents;
−Removed: • controls designed to identify and manage cybersecurity threats associated with our use of third-party service providers, suppliers and vendors with respect to our critical systems and data.
−Removed: We have not identified any cybersecurity threats, including as a result of prior incidents, that as of the date of this Annual Report have materially affected us, or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
−Removed: We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.
−Removed: However, there can be no guarantee that such controls, policies and procedures will be fully implemented and properly followed in every instance, or that those investments or policies and procedures will be effective.
−Removed: We therefore can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.
+Added: • controls designed to identify, detect, assess and manage reasonably foreseeable cybersecurity threats associated with our use of key third-party service providers, suppliers and vendors with respect to our critical systems and data based on our assessment of how critical they are to our operations and respective risk profile .
+Added: We have not identified any cybersecurity threats, including as a result of prior incidents, that as of the date of this Annual Report have materially affected us, including our operations, business strategy, results of operations, or financial condition.
+Added: We face risk from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
For more information regarding the risks we face from cybersecurity threats, please see Part I, Item 1A.
−Removed: “Risk Factors—Risks Related to Privacy, Consumer Protection and Cybersecurity—Any significant interruptions, delays or discontinuations in service or disruptions in or unauthorized access to our information technology systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, including subscriber and corporate information, or theft of intellectual property, including digital content assets, which could adversely impact our business."
+Added: “Risk Factors—Risks Related to Privacy, Consumer Protection and Cybersecurity."
Cybersecurity Governance
−Removed: Table o f Contents
−Removed: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.
−Removed: The Audit Committee oversees management’s implementation of our cybersecurity risk management program.
+Added: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Audit Committee") oversight of cybersecurity risks, including the oversight of management’s implementation of our cybersecurity risk management program.
The Committee receives quarterly reports from management and our internal cybersecurity personnel, including our Senior Director of Cybersecurity, on our cybersecurity risks.
−Removed: In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.
+Added: In addition, management updates the Audit Committee, when it deems appropriate, regarding cybersecurity incidents it considers to be significant.
The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.
2 unchanged sentences
The management team has broad experience in overseeing and managing enterprise risk, governance and compliance functions, and supervises both our internal cybersecurity personnel, including our Senior Director of Cybersecurity who reports directly to our Chief Financial Officer, and external cybersecurity consultants retained from time to time, in each case who have broad cybersecurity experience and expertise, including in threat assessments and detection, mitigation technologies, training, incident response, cyber forensics, insider threats and regulatory compliance.
−Removed: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel;
+Added: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel;
threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us from time to time to review and assess our cyber programs and policies;
−Removed: and alerts and reports produced by security tools deployed in the IT environment.
+Added: and alerts and reports produced by security tools deployed in our IT environment.
In addition, our Chief Financial Officer, Chief Technology Officer and Chief Legal Officer are members of our internal Cybersecurity Governance Committee, chaired by the Senior Director of Cybersecurity, a management committee comprised of leadership from primary corporate functions including Finance, Human Resources, Information Technology, Engineering, Internal Audit and Legal, which meets quarterly to drive alignment on security decisions across the Company, including reviewing security performance metrics, identifying security risks, and assessing the status of approved security enhancements.
−Removed: Table o f Contents
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.