14 unchanged sentences
The policy sets forth, among other things, the following actions in the event of a suspected security breach:
−Removed: incident verification by our cybersecurity team, notification of our ERM committee, notification of an incident response and disclosure team composed of members of our operations, legal, finance and compliance teams, mitigation and remediation actions, and steps to restore business continuity.
+Added: incident verification by our cybersecurity team;
+Added: notification of our cybersecurity committee, which oversees incident response;
+Added: assessment of potential impact and materiality;
+Added: notification of our incident disclosure response team;
+Added: coordination regarding internal and external communications, including preparation of disclosures on Form 8-K, as necessary;
+Added: and determination of mitigation and remediation actions with the goal of restoring business continuity.
Our Chief Technology Officer (“CTO”) serves as security coordinator and leads our cybersecurity and information technology team.
5 unchanged sentences
Our cybersecurity processes are integrated into our Company’s overall risk management processes .
−Removed: Our CTO is a member of our ERM committee and any cybersecurity issues are immediately raised to the committee.
+Added: Our CTO is a member of our cybersecurity and ERM committees and cybersecurity issues are raised to these committees.
In addition, our CTO reports to the audit committee of our board of directors bi-annually, regarding our cybersecurity program and material risks, and once annually to our full board of directors, regarding overall cybersecurity strategy .
10 unchanged sentences
On the management side, our ERM committee oversees the firm’s risk management process, which includes oversight of cybersecurity.
−Removed: Our CTO is a member of this committee, along with other of the most senior professionals at the firm, including our chief operating officer who is also our chief risk officer.
−Removed: Our CTO updates the ERM committee on cybersecurity matters on a quarterly and as-needed basis.
+Added: In addition, we have a cybersecurity committee that directly oversees the firm’s cybersecurity program and is responsible for cybersecurity strategy, risk assessment and management, and incident response management.
+Added: Our CTO is a member of the cybersecurity committee, along with other of the most senior professionals at the firm, including our chief operating officer (who is also our chief risk officer) and chief compliance officer.
+Added: Our CTO also updates our ERM committee on cybersecurity matters on a quarterly and as-needed basis.
Our CTO has over 20 years of technology and cybersecurity-related experience.
3 unchanged sentences
To support management’s role in assessing and managing cybersecurity threats, our cybersecurity team conducts periodic security review meetings designed to identify vulnerabilities and review remediation efforts.
−Removed: In addition, we maintain a comprehensive Security Response Policy, which sets forth various actions
−Removed: to be taken in the event of a suspected security breach, including incident verification by our cybersecurity team, notification of our ERM committee, and mitigation and remediation actions.
+Added: In addition, we maintain a comprehensive Security Response Policy, which sets forth various actions to be taken in the event of a suspected security breach, including incident verification by our cybersecurity team, notification of our cybersecurity committee, and mitigation and remediation actions.
We also have a range of controls designed to identify, assess, mitigate, manage, and thereby seek to minimize the cybersecurity risks associated with the engagement of third-party service providers.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.