UNRESOLVED STAFF COMMENTS.
+Added: Table of Conten t s
CYBERSECURITY.
8 unchanged sentences
The company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems.
−Removed: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, had not materially affected the company, including our business strategy, results of operations, or financial condition.
+Added: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations, or financial condition.
We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company.
−Removed: Risk Factors “ — Our systems, infrastructure or data, or those used by our CROs, CMOs, clinical sites or other contractors or consultants, may or may be perceived to fail or suffer a cyberattack, security breach or other incident, including a breakdown or compromise of the confidentiality, integrity and availability of our system s , network s or data, which could adversely affect the operation of our business and reputation ” for more information regarding cybersecurity risks and the potential impact on the company.
+Added: “Risk Factors— Our systems, infrastructure or data, or those used by our CROs, CMOs, clinical sites or other contractors or consultants, may or may be perceived to fail or suffer a cyberattack, security breach or other incident, including a breakdown or compromise of the confidentiality, integrity and availability of our systems, networks or data, which could adversely affect the operation of our business and reputation ” for more information regarding cybersecurity risks and the potential impact on the company.
Incident Response
12 unchanged sentences
The CIO provides quarterly reports to the Committee on information security matters, including the adequacy and effectiveness of the company’s information security policies and practices and the internal controls regarding information security, and notifies the chairperson of the Committee as soon as practicable of significant information security matters and concerns as they arise.
+Added: Table of Conten t s
Management’s Role
21 unchanged sentences
Following such evaluation, the company determines and prioritizes service provider risk based on the potential threat impact and likelihood, and such risk determination drives the level of due diligence and ongoing compliance monitoring required for each service provider.
+Added: Table of Conten t s
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.