7 unchanged sentences
We have implemented a comprehensive set of processes for assessing, identifying, and managing material risks from cybersecurity threats.
−Removed: We conduct continuous vulnerability scanning and periodic penetration tests and evaluate key infrastructure and applications for general IT controls through SOX testing and other required regulatory practices.
+Added: We conduct continuous vulnerability scanning and periodic penetration tests to evaluate risks in key infrastructure and applications as part of ongoing cybersecurity management and in accordance with required regulatory practices.
Any observations are ranked by severity and prioritized for response and remediation.
3 unchanged sentences
We execute this review process as we onboard a new vendor or renew a contract with an existing vendor, or when there are significant changes in the scope of services provided by the vendor.
−Removed: Key vendors are reassessed on a periodic basis to confirm their control environment remains secure and meets our expectations.
−Removed: Furthermore, starting in 2024, we have enhanced this process to perform annual reviews of key vendors with elevated risks.
+Added: Key vendors are reassessed annually to confirm their control environment remains secure and meets our expectations.
Our platform is continuously probed and attacked by malicious actors, and accordingly, the controls and practices utilized by our cybersecurity and technology teams have continued to evolve.
−Removed: We utilize a Security Information and Event Management (SIEM) tool and Security Operations Center (SOC) provider to actively support our ability to monitor, alert, and remediate issues on a continuous basis and to protect the Company from material security breaches or unauthorized access to our environment.
+Added: We utilize a Security Information and Event Management (SIEM) tool and Security Operations Center (SOC) provider to actively support our ability to monitor, alert, and remediate issues on a continuous basis and to protect our company from material security breaches or unauthorized access to our environment.
Additionally, we employ a dedicated cybersecurity team to closely work with the SOC, key vendors, and internal stakeholders to maintain familiarity with our operations and configure systems to alert on risks to the organization using industry and business insights.
1 unchanged sentence
These various threat and vulnerability alerts allow our cybersecurity team and trusted partners, such as hosting vendors and other critical service providers, to quickly respond to identified risks.
−Removed: Additionally, a periodic NIST-based risk assessment is performed by an independent third party to assist our cybersecurity team in confirming our cybersecurity control environment is in compliance with recognized cybersecurity industry frameworks and standards, as well as identifying any opportunities for enhancement.
+Added: Additionally, a periodic NIST-based risk assessment is performed by an independent third party to assist our cybersecurity team in confirming our cybersecurity control environment is in conformance with recognized cybersecurity industry frameworks and standards, as well as identifying any opportunities for enhancement.
We also regularly train our employees on cybersecurity awareness, confidential information protection, and phishing attacks.
1 unchanged sentence
For a discussion of whether and how any risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, see Part I, Item 1A:
−Removed: “Risk Factors,” which should be read in conjunction with Part I, Item 1C.
+Added: “Risk Factors,” which should be read in conjunction with this Part I, Item 1C.
Our Board of Directors maintains overall oversight of our risk management.
−Removed: The Audit Committee is specifically tasked with reviewing cybersecurity and other information technology risks, controls, and procedures, including our plans to mitigate
−Removed: cybersecurity risks and to respond to data breaches.
+Added: The Audit Committee is specifically tasked with reviewing cybersecurity and other information technology risks, controls, and procedures, including our plans to mitigate cybersecurity risks and to respond to data breaches.
The Audit Committee also reviews with management any specific cybersecurity issues that could affect the adequacy of our internal controls.
−Removed: Our Head of Information Security reports to the Audit Committee on a quarterly basis on any relevant cybersecurity issues or risks, related controls, procedures and programming, material cybersecurity and data privacy incidents (if any), any material updates to our cybersecurity risk management and strategy, broader cybersecurity trends, and relevant educational information.
+Added: Our Head of Information Security reports to the Audit Committee on a quarterly basis on any relevant cybersecurity issues or risks, related controls, procedures and programming, material cybersecurity and data privacy incidents (if any), as well as any material updates to our cybersecurity risk management and strategy, broader cybersecurity trends, and relevant educational information.
We employ a cybersecurity team of seasoned professionals with direct experience in securing both large and small enterprises.
The team is led by our Head of Information Security , who reports to the Chief Operating Officer (COO) .
−Removed: The Head of Information Security has 18 years of experience in various technology leadership roles.
+Added: The Head of Information Security has nearly 20 years of experience in various technology leadership roles.
Of these, the last 10 years have specifically focused on building, managing, and supporting robust security programs across highly regulated industries.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.