3 unchanged sentences
GitLab’s cybersecurity program was designed in alignment with industry standards and recognized best practices to identify, assess, and manage material risks from cybersecurity threats.
+Added: Our cybersecurity program is led by our Chief Information Security Officer, who has over 25 years of experience working at SaaS and technology companies, and consists of over 120 security practitioners located around the world.
Our processes assess the likelihood and impact of various threats and risks including, but not limited to, our business operations, organizational output, brand reputation, business continuity, customers and stakeholders, legal, regulatory, and financial impact.
−Removed: Identified risks are assessed for criticality, prioritized for remediation, and reported by GitLab's security teams to various levels of our management.
+Added: Identified risks are assessed for criticality, prioritized for remediation, and reported by GitLab's security teams to various levels of our management including integration into our enterprise risk management program, led by Internal Audit.
We also make judgments based on current data, assumptions about the risk, the company’s risk tolerance, impact to confidentiality, integrity, and availability, and reasonable analysis of costs associated with mitigating or reducing the severity of the risk.
1 unchanged sentence
Security incidents that are assessed as potentially material are escalated to designated members of our management and board of directors, as applicable.
+Added: Our global incident response team performs at-least annual tabletop exercises of our incident processes, including material breach, disaster recovery, and business continuity scenarios.
Our security program accounts for our significant interactions with relevant external third-parties and analyzes the potential risks introduced from doing business with them.
These risks are continually assessed throughout the vendor lifecycle from onboarding to offboarding.
−Removed: We also engage in continuous monitoring of our cyber security risks and perform security assurance activities via independent, external third parties such as consultants, auditors, and assessors during our robust security certification audits, penetration tests, and bug bounty programs.
+Added: We also engage in continuous monitoring of our cyber security risks and perform security assurance activities via independent, external third parties such as consultants, auditors, security researchers, and assessors during our robust security certification audits, penetration tests, and bug bounty programs.
As of the date of this Form 10-K, to the best of our knowledge and based on available data, we have not experienced a material cybersecurity incident that has resulted in a material adverse impact to our business or operations.
8 unchanged sentences
Accordingly, we do not maintain a headquarters.
−Removed: Our China entity (JiHu) leases small sales offices.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.