3 unchanged sentences
The Company recognizes the critical importance of developing, implementing, and maintaining effective cybersecurity measures to protect our information systems and provide for the confidentiality, integrity, and availability of our data, as well as that of our customers, business partners and employees.
−Removed: Our cybersecurity processes are integrated into our overall enterprise risk management framework so that cybersecurity risks can be evaluated and managed alongside other business risks.
+Added: Our cybersecurity processes are integrated into our overall enterprise risk management framework so that cybersecurity risks can
+Added: be evaluated and managed alongside other business risks.
Such integration supports our effort to promote a company-wide culture of cybersecurity risk management.
8 unchanged sentences
and the feasibility, cost and impact of controls.
−Removed: The specific controls used by the Company vary based on the systems and program involved, but typically include vulnerability and patch management, penetration testing, firewalls, intrusion prevention and detection systems, anti-malware (including anti-phishing) technical safeguards and access controls, privileged access management, endpoint threat detection and response, identity and access management, multi-factor authentication, logging and monitoring, cyber insurance, and physical security controls.
+Added: The specific controls used by the Company vary based on the systems and program involved, but typically include vulnerability and patch management, penetration testing, firewalls, intrusion prevention and detection systems, anti-malware (including anti-phishing) technical safeguards and access controls, privileged access management, endpoint threat detection and response, identity and access management, multi-factor authentication, logging and monitoring, data encryption, backup and recovery systems, cyber insurance, and physical security controls.
The Company also incorporates threat intelligence and monitors emerging cybersecurity threats relevant to the BPO industry.
14 unchanged sentences
Education and Awareness .
−Removed: The Company provides regular, mandatory training for all personnel on cybersecurity threats and has processes and procedures in place to communicate out-of-cycle notices and
−Removed: updates regarding the Company’s information security policies, standards, processes, and practices by the CTO as needed.
+Added: The Company provides regular, mandatory training for all personnel on cybersecurity threats and has processes and procedures in place to communicate out-of-cycle notices and updates regarding the Company’s information security policies, standards, processes, and practices by the Chief Technology Officer (“CTO”) as needed.
As indicated above, we utilize a risk-based methodology to determine which security controls are appropriate for a particular circumstance, and it is possible we may not implement suitable controls if we fail to perceive, or underrate, a particular risk.
1 unchanged sentence
The Company’s Board is responsible for overseeing cybersecurity risk management as part of its oversight of the Company’s enterprise risk management framework.
+Added: The Board receives periodic updates from management
+Added: on cybersecurity strategy, risk assessments, and significant developments but is not involved in day-to-day operational decision-making.
The Company’s management team is responsible for the day-to-day oversight and management of cybersecurity risks, supported by our dedicated professionals responsible for cybersecurity, fraud, risk management, and compliance.
Additionally, our Cybersecurity Committee, which is composed of certain of our executive management, legal and operations leaders, provides sponsorship and guidance to help achieve our management objectives.
−Removed: Our Vice President for IT Data Security (“VP, IT Data Security”) reports to our Chief Technology Officer (“CTO”) and assists in the day-to-day management of cybersecurity risks by leading the Information Security department and operationalizing our Information Security management systems.
−Removed: Our current VP, IT Data Security, has led our Data Security Department for nine years and holds more than seventeen years of experience in cybersecurity, including security operations, cloud security, and risk management.
+Added: Our Chief Information Security Officer (“CISO”) reports to our CTO and assists in the day-to-day management of cybersecurity risks by leading the Information Security department and operationalizing our Information Security management systems.
+Added: Our current CISO has led our Data Security Department for ten years and holds more than eighteen years of experience in cybersecurity, including security operations, cloud security, and risk management.
He has extensive experience with enterprise information security controls and frameworks, such as ISO 27001, PCI DSS, SOC 2 Type II, and HITRUST.
−Removed: Additionally, he holds multiple certifications, including CIISSP (Certified Information Systems Security Professional), CISA (Certified Information Security Auditor), and CISM (Certified Information Security Manager).
−Removed: The CTO and VP, IT Data Security meet regularly with the Cybersecurity Committee to review the Company’s management of information security risks, and the Cybersecurity Committee evaluates the adequacy of the Company’s IT security program, compliance and controls with our CTO.
+Added: Additionally, our CISO holds multiple professional certifications, including CIISSP (Certified Information Systems Security Professional), CISA (Certified Information Security Auditor), and CISM (Certified Information Security Manager ).
+Added: The CTO and CISO meet regularly with the Cybersecurity Committee to review the Company’s management of information security risks, and the Cybersecurity Committee evaluates the adequacy of the Company’s IT security program, compliance and controls with our CTO.
In addition to scheduled meetings, the CTO, Cybersecurity Committee, and CEO maintain a regular dialogue regarding emerging or potential cybersecurity risks, which may include input from our third party vendors and other external sources.
3 unchanged sentences
Cybersecurity Threats
−Removed: The Company previously experienced a cybersecurity incident in August of 2020.
−Removed: Although cybersecurity threats, including any previous cybersecurity incidents, have not materially affected the Company’s business strategy, results of operations or financial condition, there can be no assurances that future cybersecurity incidents, which are unavoidable, will not materially affect our results of operations, including our business strategy, results of operations, or financial condition.
+Added: We have implemented additional technical and procedural safeguards over time to strengthen our security posture, including enhanced incident response protocols and employee awareness training.
+Added: Although cybersecurity threats in the last fiscal year have not materially affected the Company’s business strategy, results of operations or financial condition, there can be no assurances that future cybersecurity incidents, which are unavoidable, will not materially affect our results of operations, including our business strategy, results of operations, or financial condition.
Additional information on cybersecurity risks we face can be found in Part I, Item 1A.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.