5 unchanged sentences
Risk Assessment and Management
−Removed: We manage material risks from cybersecurity threats through a cross-functional and layered approach that is designed to detect, identify, respond to, recover from and protect from cybersecurity incidents and is informed by industry recognized standards.
+Added: We manage material risks from cybersecurity threats through a cross-functional and layered approach that is designed to detect, identify, respond to, recover from and protect against cybersecurity incidents, and which is informed by industry recognized standards.
Our security governance function, which includes key employees who work in Information Security, Legal, and Privacy teams, such as our Chief Information Officer (“CIO”) and Chief Information Security Officer (“CISO”), are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our enterprise Incident Response Plan (“IRP”), managing incident response, and overseeing any policy exceptions and potential compensating controls.
−Removed: Additionally, we assess our cybersecurity maturity annually and implement and maintain controls that are designed to evaluate and improve our cybersecurity program, such as vulnerability assessments and penetration tests, as needed.
−Removed: We also execute employee cybersecurity training and awareness programs around various key cybersecurity topics, including reporting incidents, phishing, ransomware, remote working, cloud security, privileged access and removable media.
+Added: Additionally, we assess our cybersecurity program’s maturity annually and implement and maintain controls that are designed to evaluate and improve our cybersecurity program, such as vulnerability assessments and penetration tests, as needed.
+Added: We also maintain employee cybersecurity training and awareness programs around various cybersecurity topics, including reporting incidents, phishing, ransomware, remote working, cloud security, privileged access and removable media.
Our process for assessing, identifying and managing material risks from cybersecurity threats is integrated into our overall risk management process.
6 unchanged sentences
Incident Response
−Removed: We have a dedicated Information Security team responsible for managing and coordinating incident response efforts.
+Added: We have a dedicated Information Security team, whose duties include managing and coordinating incident response efforts.
This team collaborates closely with other teams within the company, including teams within information technology (“IT”), Legal and Privacy, in identifying, analyzing and responding to cybersecurity incidents, which includes tracking cybersecurity incidents to help identify any related incidents.
1 unchanged sentence
Where necessary or appropriate, we also engage third-party advisors to assist in the incident response process.
−Removed: We have an IRP to prepare for and respond to cybersecurity incidents.
−Removed: Our IRP processes are tested in annual tabletop exercises to help identify strengths and areas for improvement.
−Removed: Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate.
+Added: We have an IRP designed to assist the company to prepare for and respond to cybersecurity incidents, and which also provides for escalation to management based on incident severity.
+Added: Our IRP processes are regularly tested, including through tabletop exercises designed to help identify strengths and areas for improvement, and we update our IRP process as appropriate.
Third-Party Service Provider Risk Management
1 unchanged sentence
The company uses an external risk management software program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks.
−Removed: Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor’s controls for IT security, privacy, business continuity and other third-party risks.
+Added: Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor controls for IT security, privacy, business continuity and other third-party risks.
Following an evaluation, the company determines and prioritizes risks based on their potential impact, which helps inform the appropriate level of additional due diligence and ongoing compliance monitoring.
2 unchanged sentences
Like many companies, we face cybersecurity threats and have experienced cybersecurity incidents, including data breaches and temporary service interruptions.
−Removed: However, since the beginning of fiscal year 2024, the company has not identified risks from known cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us.
+Added: Since the beginning of fiscal year 2025, the company has not identified risks from known cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us.
Nevertheless, there can be no assurance that our efforts in response to cybersecurity incidents, as well as our investments to protect our IT infrastructure and data, will shield us from significant losses, brand and reputational harm and potential liability or prevent any future interruption or breach of our systems.
13 unchanged sentences
Management’s Role in Assessing and Managing Material Risks from Cybersecurity Threats
−Removed: Our CISO, supported by a cross-functional team, has primary responsibility for assessing and managing our cybersecurity program and the related risks.
+Added: Our CIO and CISO, supported by a cross-functional team, have primary responsibility for assessing and managing our cybersecurity program and the related risks.
Details of the risk management and escalation processes are discussed in “Cybersecurity Risk Management and Strategy” above.
−Removed: The CISO has over 30 years of IT and cybersecurity experience in large biopharmaceutical, life sciences, financial and technology industries, including over ten years with the company, and is responsible for managing the security architecture, engineering, technology operations, monitoring, incident response, risk, governance, quality and compliance at the company.
−Removed: The company’s Information Security function is comprised of teams that engage in a range of cybersecurity activities such as security operations, security engineering, data privacy controls, validation, compliance and audit readiness.
+Added: Our CIO has over 20 years of IT and cybersecurity experience in large biopharmaceutical and life sciences industries, having served in various roles of increasing leadership at a global biopharmaceutical company before joining the company in April 2025.
+Added: In her current role, the CIO is responsible for implementing enterprise-wide IT and AI strategies for the company.
+Added: Our CISO has over 30 years of IT and cybersecurity experience in large biopharmaceutical, life sciences, financial and technology industries, including over ten years with the company, and is responsible for managing the security architecture, engineering, technology operations, monitoring, incident response, risk, governance, quality and compliance at the company.
+Added: The company’s Information Security group, which reports to the CISO, is comprised of teams that engage in a range of cybersecurity activities such as security operations, security engineering, data privacy controls, validation, compliance and audit readiness.
Leaders of each team are expected to collaborate to help increase visibility of key issues and alignment with strategy.
−Removed: As noted above, the company’s IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CISO.
−Removed: The company’s incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.
+Added: As noted above, the company’s IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CIO and CISO.
+Added: The company engages external legal advisors, cybersecurity forensic firms, communication specialists and other third-party advisors, as appropriate, to assist and advise on cybersecurity program review, cybersecurity program testing and incident response.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.