3 unchanged sentences
We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K.
−Removed: These risks include, among other things:
+Added: Accordingly, the company takes a comprehensive approach to identifying and managing cybersecurity risks that involves the company's Information Security functional team, senior management, and our board of directors in coordination with the Technology and Information Security (“T&IS”) Committee and the Audit Committee of our board of directors.
+Added: Our cybersecurity risk management function is a component of our overall approach to risk management, including coordination with our Enterprise Risk Management Committee.
+Added: Our cybersecurity risks include, among other things:
operational risks, malicious attacks, improper employee or contractor access, harm to employees or customers and violation of data privacy, intellectual property or security laws.
2 unchanged sentences
“Risk Factors.”
−Removed: We have an enterprise-wide cybersecurity strategy that focuses on implementing risk-based controls, technologies, and other processes.
+Added: We have a cybersecurity program that focuses on implementing risk-based controls, technologies, and other processes.
We aim to incorporate industry best practices throughout our cybersecurity program, including the frameworks established by the National Institute of Standards and Technology (“NIST”), the Cybersecurity and Infrastructure Security Agency (“CISA”), and other applicable industry standards.
To augment our in-house capabilities, we leverage expertise from professional services firms and/or outside counsel, as needed, to assess our cybersecurity controls, and collaborate on an ever-changing landscape.
−Removed: Our cybersecurity program is verified as conforming with ISO/IEC 27001:2013 and our most recent recertification was in 2023.
−Removed: We use various mechanisms to preempt, detect and monitor cybersecurity threats, including monitoring unusual network activity, conducting annual security awareness training for employees, deploying phishing test campaigns, maintaining containment and incident response tools, and reviewing, updating and improving our Incident Response Plan annually.
+Added: Our cybersecurity program conforms with ISO/IEC 27001:2022 and our most recent recertification was in 2024.
+Added: We use various mechanisms to detect and monitor cybersecurity threats, including monitoring unusual network activity, conducting annual security awareness training for employees, deploying phishing test campaigns, maintaining containment and incident response tools, and reviewing, updating and improving our Incident Response Plan annually.
We also conduct tabletop exercises to simulate responses to cybersecurity incidents.
During these exercises, our team of cybersecurity professionals collaborate with technical and business stakeholders across the organization to further analyze the risk to the company and form detection, mitigation, and remediation improvements.
+Added: We also engage third parties, including assessors, consultants, and auditors to assess our cybersecurity control environment and to test the vulnerability of our cybersecurity infrastructure at least annually.
Our risk management program also assesses risks associated with third-party service providers.
−Removed: S uch providers are subject to an onboarding process and may be reevaluated periodically, such as upon detection of an increase in risk profile.
−Removed: We use a variety of inputs in such risk assessments, including information supplied by providers and third parties.
−Removed: In addition, our service providers adhere to mutually agreed upon security requirements, controls and responsibilities.
+Added: S uch providers are subject to an onboarding process and may be reevaluated periodically.
+Added: We use a variety of inputs in such risk assessments, including information supplied by the providers themselves and other third parties.
+Added: In addition, our contracts with our service providers require them to adhere to mutually agreed upon security requirements, controls and responsibilities, as applicable.
Cybersecurity Governance
−Removed: Our cybersecurity program is overseen by the leaders of our Information Security functional team, which is led by our Chief Information Officer (“CIO”) who has nearly 30 years of relevant work experience.
−Removed: Prior to joining Huron in 2018, our CIO served in various information security and information technology roles in the professional services industry for several large, public companies and executed large-scale, global implementations of business applications and infrastructure technologies in a way that mitigates cybersecurity risks.
−Removed: Our CIO reports on a quarterly basis to Huron's internal Information Security Management System (“ISMS”) Committee, which has primary responsibility for assessing and managing material cybersecurity risks.
+Added: Our cybersecurity program is overseen by the leaders of our Information Security functional team, which is led by our Chief Information Officer (“CIO”) who has over 30 years of relevant work experience.
+Added: Prior to joining Huron in 2018, our CIO served in various information security and information technology roles in the professional services industry for several large, public companies and executed large-scale, global implementations of business applications and infrastructure technologies in a manner designed to mitigate cybersecurity risks.
+Added: Our CIO reports on a quarterly basis to Huron's internal Information Security Management System (“ISMS”) Committee, which has the primary responsibility for assessing and managing material cybersecurity risks.
The ISMS Committee, which includes members of our executive and senior leadership teams, our CIO and other functional team leaders , reviews, approves and establishes ISMS specific goals and objectives, reviews policy updates and approves the annual IT risk assessment, which identifies impacts, threats and controls related to IT assets utilized across the enterprise.
−Removed: Our board of directors, in coordination with the board of director’s Technology and Information Security (“T&IS”) Committee, oversees the governance of the Company’s technology-related risks, including information security, data protection, cybersecurity, vendor, fraud, and business continuity risks, and technology-related strategies.
+Added: Our board of directors, in coordination with its T&IS Committee, oversees the governance of the Company’s technology-related risks, including information security, data protection, cybersecurity, vendor, fraud, and business continuity risks, and technology-related strategies.
The T&IS Committee receives quarterly updates from the CIO, including existing and new cybersecurity risks, the management and/or mitigation of such risks, material cybersecurity incidents (if any), and status on key cybersecurity initiatives.
−Removed: Our board also actively participates in discussions with management on cybersecurity-related news events and discusses any updates to our cybersecurity risk management and strategy programs on a timely basis.
+Added: Our board also actively participates in discussions with management on cybersecurity-related news events and discusses any updates to our cybersecurity risk management and strategy programs.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.