1 unchanged sentence
Cybersecurity
−Removed: GoDaddy maintains an enterprise-wide cybersecurity program designed to manage risks to the company's information systems from cybersecurity threats and cybersecurity incidents.
+Added: GoDaddy maintains an enterprise-wide cybersecurity program designed to manage cybersecurity risk.
Board and Audit and Finance Committee Governance
−Removed: Our board of directors (the Board) is committed to managing data privacy and cybersecurity risks as part of the company's overall risk management framework.
+Added: Our board of directors (the Board) manages cybersecurity risks as part of the company's overall risk management framework.
The Board oversees the company's cybersecurity risk management program through the Board's Audit and Finance Committee (the Audit Committee).
−Removed: The Audit Committee is responsible for overseeing and reviewing with management GoDaddy's cybersecurity matters.
−Removed: The Audit Committee receives verbal and written reports at least quarterly from GoDaddy's Chief Information Security Officer (CISO) regarding the state of the company's cybersecurity risk management program, the company's current material cybersecurity risks, and general cybersecurity-related risks.
−Removed: The Audit Committee consists of Board members with a diversity of expertise in risk management, technology, finance and cybersecurity, including oversight of security teams.
−Removed: In addition, the company's CISO and Chief Technology Officer (CTO) provide the full Board with written quarterly and annual reports on the state of the company's cybersecurity program and material cybersecurity-related risks, and the chair of the Audit Committee provides a quarterly summary of the Audit Committee's cybersecurity discussion to the full Board.
+Added: The Audit Committee receives verbal and written reports at least quarterly from GoDaddy's Chief Information Security Officer (CISO) regarding our company's cybersecurity risk management program and cybersecurity-related risks.
+Added: The Audit Committee consists of Board members with diverse expertise in risk management, technology, finance and cybersecurity, including oversight of security teams.
+Added: Our CISO provides the full Board with written quarterly and annual reports on our cybersecurity program and material cybersecurity-related risks, and the chair of the Audit Committee provides a quarterly summary of the Audit Committee's cybersecurity discussion to the full Board .
Management of Cybersecurity Risk
−Removed: GoDaddy management is responsible for identifying, assessing, and managing the company's material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures and maintaining the company's cybersecurity programs.
−Removed: GoDaddy's CISO has primary responsibility for overseeing the company's programs for identifying, assessing, and managing the company's cybersecurity risks.
−Removed: The CISO reports directly to the company's CTO and also regularly provides reports and updates to the company's CEO on significant cybersecurity-related matters relevant to the company's cybersecurity risk.
−Removed: The company's CISO has more than 18 years' experience in cybersecurity, networking, and related technologies.
−Removed: The company's CTO has more than 25 years' experience in network security and other related technologies.
−Removed: The company's CEO has more than 27 years' experience in ecommerce technology, engineering, and other related areas.
−Removed: The CISO, CTO, and CEO work together to assess and manage cybersecurity-related risks.
−Removed: The CISO is responsible for day-to-day operations working with an enterprise-wide cybersecurity team that provides 24/7/365 support.
−Removed: The CISO regularly confers with the CTO and CEO on cybersecurity matters, including providing notice of cybersecurity threats and incidents, including those that have the potential to have material effects.
−Removed: The CISO also provides written monthly and quarterly reports on the state of the company's cybersecurity program and cybersecurity risks to the CTO, CEO, and other key executives.
−Removed: As noted above, the CISO and CTO also provide regular reports to the Audit Committee and the Board.
−Removed: The company's cybersecurity policies, procedures, and strategies primarily are implemented by the company's information security department, which reports directly to the CISO.
−Removed: The company's information security department performs functions that include but are not limited to general security operations, event monitoring, incident response, vulnerability management, policy and procedure development, security compliance, product development support, product security readiness testing, third-party vendor security assessments, and penetration testing.
−Removed: Other personnel and departments in the company also assist with cybersecurity risk management, including but not limited to the company's technology organization and the company's privacy, legal, third-party risk management, and corporate audit services teams.
−Removed: The company also has developed processes to integrate cybersecurity risk management within the company's product and software development processes.
−Removed: In addition, product teams and business unit leaders are involved in cybersecurity risk management during product development with support from our enterprise-wide security team supervised by the CISO.
+Added: Our senior management is responsible for identifying, assessing, and managing the company's material cybersecurity risks.
+Added: Our CISO oversees our programs for identifying, assessing, and managing our cybersecurity risks.
+Added: Our CISO reports to our Chief Operating Officer (COO) and regularly provides updates to our CEO on significant cybersecurity-related matters.
+Added: Our CISO also provides written monthly and quarterly reports on our cybersecurity program and risks to the CEO, Chief Technology Officer, and other key executives.
+Added: Our CISO has more than 19 years' experience in cybersecurity, networking, and related technologies.
+Added: Our CEO has more than 28 years' experience in e-commerce technology, engineering, and other related areas.
+Added: Our CISO works with an enterprise-wide cybersecurity team that provides 24/7/365 support.
+Added: Our cybersecurity policies, procedures, and strategies primarily are implemented by our information security department.
+Added: Other personnel and departments in the company also assist with cybersecurity risk management, including but not limited to our technology organization and our privacy, legal, vendor risk management, and corporate audit services teams.
+Added: We have also developed processes to integrate cybersecurity risk management within the company's product and software development processes.
+Added: In addition, product teams and business unit leaders are involved in product-related cybersecurity risk management.
Third-Party Consultants and Auditors
−Removed: GoDaddy maintains industry certifications for some of the services we provide, including certifications relating to our GoDaddy Registrar, Registry, Domains, and Commerce businesses.
−Removed: We use third-party auditors and consultants in connection with obtaining and maintaining our certifications for certain products and services.
−Removed: We also have engaged third-party consultants in the past and may engage third-party consultants in the future for specific projects and engagements, such as responding to cybersecurity incidents.
+Added: We use uses third-party auditors and consultants in connection with obtaining and maintaining industry certifications for certain products and services.
+Added: We also have engaged third-party consultants in the past and may engage third-party consultants in
+Added: the future for specific projects and engagements, such as responding to cybersecurity incidents.
Our third-party financial auditors also include material cybersecurity risks and events as part of their financial audits.
1 unchanged sentence
We engage with third parties to provide us with hardware, software, and services to operate our information systems and run our business.
−Removed: In particular, we host a substantial portion of our IT infrastructure and data on services maintained by Amazon Web Services.
−Removed: When engaging a third-party vendor or service provider, we use a variety of processes and controls to identify and oversee risks relating to that engagement, which may include one or more of the following depending on the scope and nature of the engagement:
−Removed: • incorporating provisions in vendor contracts that require third parties meet certain minimum cybersecurity standards based on the nature of the product or service provided;
−Removed: • installing monitoring software and other tools to detect malicious software and activities in systems operated by third parties;
−Removed: • maintaining processes for monitoring for and applying updates and patches to third-party hardware and software to address vulnerabilities;
−Removed: • performing security and data privacy assessments before engaging new vendors or acquiring new hardware and software.
We also rely on third parties to provide hardware, software, and services relating to our cybersecurity program.
−Removed: We apply similar controls to third-party providers of cybersecurity services that we apply to other IT hardware, software, and services described above.
−Removed: Our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties.
−Removed: Additionally, any contractual protections with such third parties,
−Removed: including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.
+Added: When engaging a third-party vendor or service provider, we use a variety of processes and controls to identify and oversee risks relating to that engagement, which may include one or more of the following:
+Added: • including provisions in vendor contracts that set minimum cybersecurity requirements;
+Added: • installing monitoring software to detect malicious software and activities in third party systems;
+Added: • monitoring for and applying patches to third-party hardware and software to address vulnerabilities;
+Added: • performing security assessments before engaging new vendors or acquiring new hardware and software.
+Added: Despite our efforts, our control over and ability to monitor the security of third parties is limited and there can be no assurance that we can prevent, mitigate or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by third parties.
+Added: Additionally, any contractual protections with such third parties may be limited or insufficient to prevent a negative impact on our business from such compromise or failure.
Cybersecurity Threat Monitoring and Incident Response
−Removed: GoDaddy monitors for threats to our information systems on an ongoing basis through a combination of automated intrusion detection monitoring solutions, review of log data, and other related activities.
−Removed: We also require security training for all GoDaddy personnel, including instructions regarding the proper methods for reporting potential cybersecurity incidents that are not captured through our monitoring solutions.
−Removed: We also provide mechanisms for interested third parties, including security researchers and law enforcement to provide us notice of potential cybersecurity threats.
−Removed: Potential and actual cybersecurity incidents primarily are handled by our internal incident response team, which is supervised by our CISO.
+Added: We monitor for threats to our information systems through a combination of automated intrusion detection monitoring solutions, review of log data, and other activities.
+Added: We require security training for all company personnel, including instructions regarding the proper methods for reporting potential cybersecurity incidents.
+Added: We also provide mechanisms for interested third parties, including security researchers and law enforcement, to provide notice of potential cybersecurity threats.
+Added: In addition, we monitor third-party sources for notice of cybersecurity incidents that may affect company vendors and other parties with whom we do business.
+Added: Potential and actual cybersecurity incidents are primarily handled by our internal incident response team, which is supervised by our CISO.
Our incident response team is responsible for assessing the potential risk posed by an incident, providing notice to appropriate stakeholders in the company based on the perceived risk, and coordinating the assessment, containment, mitigation, and remediation efforts.
−Removed: Depending on the severity and scope of the incident, we may also engage external consultants.
−Removed: Security personnel and consultants retained by our service providers may also be involved in cases where our vendors experience a cybersecurity incident.
−Removed: In the event of a potentially material cybersecurity incident, we have defined processes for escalating the incident for determination of whether the incident is material and requires filing of a notification on Form 8-K or other notification required under applicable laws and regulations.
+Added: Depending on the severity and scope of the incident, we also may engage external consultants.
+Added: Security personnel and consultants retained by our service providers also may be involved in cases where our vendors experience a cybersecurity incident.
+Added: We have processes for escalating an incident to determine whether it is material and requires notification required under applicable laws, rules and regulations.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.