18 unchanged sentences
• Technical Safeguards:
−Removed: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection and prevention systems, encryption, access controls, secure coding practices and other security controls, which are regularly evaluated and improved through vulnerability assessments and penetration testing designed to identify weaknesses in our systems and networks.
+Added: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion detection and prevention systems, encryption, multi-factor authentication, privileged access management least privileged access controls, secure coding practices and other security controls, which are regularly evaluated and improved through vulnerability assessments and penetration testing designed to identify weaknesses in our systems and networks.
• Incident Response and Recovery Planning:
24 unchanged sentences
Casey O’Malley is our CISO and is responsible for the day-to-day management of the cybersecurity program.
−Removed: Casey has had a distinguished career holding IT management positions since 2015 and has been employed in the cybersecurity field since 2001.
−Removed: Casey holds a Bachelor of Science in Information Technology from Penn State University.
+Added: Casey has had a distinguished career holding IT leadership positions since 2015 and has been employed in the cybersecurity field since 2001 .
• Information Security Governance:
26 unchanged sentences
Based on the materiality assessment, we determine the appropriate disclosure to regulatory agencies, stakeholders, and the public, ensuring transparency and minimizing potential harm.
−Removed: Cybersecurity threats, including as a result of any previous cybersecurity incidents have in the past affected our business.
−Removed: On December 15, 2020, we detected a ransomware incident (the “Ransomware Incident”) impacting our operational and information technology systems, which caused service delays for our customers.
−Removed: We suffered unexpected costs and impacts from the Ransomware Incident and may in the future incur costs in connection with any future cybersecurity incidents, including infrastructure investments, remediation efforts and legal claims resulting from the above.
−Removed: It is reasonably likely to affect us, including our business strategy, results of operations or financial condition.
−Removed: For more information about our cybersecurity risks, see Item 1A, Risk Factors - “Our business is subject to cybersecurity risks.”
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.