5 unchanged sentences
Risk Assessment and Management
−Removed: Our approach to managing material risks from cybersecurity threats, which is informed in part by the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (though we do not imply that we meet any particular technical standards, specifications or requirements), is designed to detect, identify, respond to, recover from and protect from cybersecurity incidents.
+Added: We manage material risks from cybersecurity threats through a cross-functional and layered approach that is designed to detect, identify, respond to, recover from and protect from cybersecurity incidents and is informed by industry recognized standards.
Our security governance function, which includes key employees who work in Information Security, Legal, and Privacy teams, such as our Chief Information Officer (“CIO”) and Chief Information Security Officer (“CISO”), are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our enterprise Incident Response Plan (“IRP”), managing incident response, and overseeing any policy exceptions and potential compensating controls.
−Removed: Additionally, we assess our cybersecurity maturity annually using the NIST framework and implement and maintain controls that are designed to evaluate and improve our cybersecurity program, such as vulnerability assessments and penetration tests, as needed.
+Added: Additionally, we assess our cybersecurity maturity annually and implement and maintain controls that are designed to evaluate and improve our cybersecurity program, such as vulnerability assessments and penetration tests, as needed.
We also execute employee cybersecurity training and awareness programs around various key cybersecurity topics, including reporting incidents, phishing, ransomware, remote working, cloud security, privileged access and removable media.
1 unchanged sentence
We have a robust enterprise risk management (“ERM”) program that plays an important role in seeking to manage and address existing and emerging risks, including cybersecurity risks, which are critical to our overall business goals and objectives.
−Removed: The ERM team updates our CEO and his leadership team on cybersecurity risks as well as their potential impact, likelihood, potential mitigation plan, and status.
+Added: The ERM team updates our Chief Executive Officer (“CEO”) and his leadership team on cybersecurity risks as well as their potential impact, likelihood, potential mitigation plan and status.
+Added: Engagement of Third-Party Advisors
+Added: We engage third-party advisors, including assessors and cybersecurity consultants, to assess, validate and enhance our cybersecurity program.
+Added: We benefit from engaging third parties to provide specialized skills, knowledge, tools and resources.
+Added: These third parties also help reduce costs, increase efficiency, improve quality, mitigate risks and review cybersecurity strategy, trends and threat landscape.
Incident Response
2 unchanged sentences
When cybersecurity incidents are identified, our practice is to respond to and address them utilizing incident classifications and escalation protocols, in accordance with applicable governmental regulations and other legal requirements.
+Added: Where necessary or appropriate, we also engage third-party advisors to assist in the incident response process.
We have an IRP to prepare for and respond to cybersecurity incidents.
−Removed: The process is tested in annual tabletop exercises to help identify strengths and areas for improvement.
−Removed: Engagement of Third Party Advisors
−Removed: We engage third party advisors, including assessors, cybersecurity consultants, and auditors to assess, validate, and enhance our cybersecurity program.
−Removed: We benefit from engaging third parties to provide specialized skills, knowledge, tools, and resources.
−Removed: These third parties also help reduce costs, increase efficiency, improve quality, mitigate risks, and review cybersecurity strategy, trends, and threat landscape.
+Added: Our IRP processes are tested in annual tabletop exercises to help identify strengths and areas for improvement.
+Added: Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate.
Third-Party Service Provider Risk Management
2 unchanged sentences
Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor’s controls for IT security, privacy, business continuity and other third-party risks.
−Removed: Following an evaluation, the company determines and prioritizes risks based on their potential impact, which help inform the appropriate level of additional due diligence and ongoing compliance monitoring.
+Added: Following an evaluation, the company determines and prioritizes risks based on their potential impact, which helps inform the appropriate level of additional due diligence and ongoing compliance monitoring.
The third-party risk assessment is a cross-functional effort involving our end-user, Legal, Privacy and Information Security teams.
Material Risks from Cybersecurity Threats
−Removed: The company has not identified any risks from cybersecurity threats that have materially affected us.
−Removed: We do not believe that risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, over the long term.
−Removed: Like many companies, we have experienced cybersecurity incidents, including data breaches and temporary service interruptions.
−Removed: However, as of the end of 2023, known cybersecurity incidents, individually or in aggregate, have not had a material impact.
+Added: Like many companies, we face cybersecurity threats and have experienced cybersecurity incidents, including data breaches and temporary service interruptions.
+Added: However, since the beginning of fiscal year 2024, the company has not identified risks from known cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us.
Nevertheless, there can be no assurance that our efforts in response to cybersecurity incidents, as well as our investments to protect our IT infrastructure and data, will shield us from significant losses, brand and reputational harm and potential liability or prevent any future interruption or breach of our systems.
6 unchanged sentences
Our Board of Directors has established an oversight structure for monitoring the effectiveness of and risks related to the cybersecurity program.
−Removed: Designated by the Board to oversee cybersecurity and information technology risks, the Audit Committee receives quarterly cybersecurity updates from our CISO, and the chair of the Audit Committee meets with the CISO individually on a quarterly basis.
+Added: The Audit Committee has been designated by the Board to oversee cybersecurity and information technology risks.
+Added: The Audit Committee receives quarterly cybersecurity updates from our CISO, and the chair of the Audit Committee meets with the CISO individually on a quarterly basis.
These updates often address topics such as ongoing efforts to improve our cybersecurity posture, operational metrics, incident metrics and mitigation actions, and may include key metrics such as those related to cybersecurity maturity, risk reduction, cybersecurity program health, and audit and compliance activities.
The Audit Committee updates the Board on its activities at each regularly scheduled Board meeting.
−Removed: Risks related to cybersecurity events are provided to the Board on an annual basis as part of an overall ERM update.
−Removed: In addition to this regular reporting, significant cybersecurity risks may also be escalated on an as-needed basis through the company’s organizational structure in accordance with the IRP.
−Removed: Management’s Role in Assessing and Managing Materials Risks from Cybersecurity Threats
−Removed: Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate.
−Removed: Management, including the CIO and CISO, is involved in assessing and managing our cybersecurity risks.
−Removed: The CISO reports to the CIO (who in turn reports to our Chief Financial Officer, who in turn reports to the CEO), and both the CIO and CISO participate in global leadership team meetings.
−Removed: With over 26 years of experience, including over three years with the company, the CIO has been recognized externally for his leadership in technology innovation in the industry, and provides strategic leadership for the company’s IT organization.
+Added: Updates related to cybersecurity are provided to the Board on an annual basis as part of an overall ERM update.
+Added: In addition to this regular reporting, significant cybersecurity events may also be escalated on an as-needed basis through the company’s organizational structure in accordance with the IRP.
+Added: Management’s Role in Assessing and Managing Material Risks from Cybersecurity Threats
+Added: Our CISO, supported by a cross-functional team, has primary responsibility for assessing and managing our cybersecurity program and the related risks.
+Added: Details of the risk management and escalation processes are discussed in “Cybersecurity Risk Management and Strategy” above.
The CISO has over 30 years of IT and cybersecurity experience in large biopharmaceutical, life sciences, financial and technology industries, including over ten years with the company, and is responsible for managing the security architecture, engineering, technology operations, monitoring, incident response, risk, governance, quality and compliance at the company.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.