6 unchanged sentences
These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks.
−Removed: As part of our risk management process, we conduct application security and vulnerability assessments, undergo third-party penetration testing, maintain ongoing risk assessments, and monitor various third-party risk feeds.
+Added: As part of our risk management process, we conduct application security and vulnerability assessments, undergo third-party penetration testing of both our digital and physical assets, maintain ongoing risk assessments, and monitor various third-party risk feeds.
Our risk management processes also assess third party risks , and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners.
In evaluating our response to our application security assessments, penetration tests, and risk feeds, our team collaborates with technical and business stakeholders to further analyze the risk to the company, and form detection, mitigation and remediation strategies to enhance our current security program.
−Removed: Our security program is aligned to the National Institute of Standards and Technology Cybersecurity Framework Special Publication (NIST) 800-53 standard, and we have passed a SOC 2 type 1 audit.
+Added: Our security program is aligned to the National Institute of Standards and Technology Cybersecurity Framework Special Publication (NIST) 800-53 standard, and we have obtained a SOC 2 Type 2 Certification.
Although we refer to such frameworks in developing our cybersecurity risk management approaches, our use of them as guides is not intended to suggest that we meet any particular technical standards, specifications, or requirements set forth therein.
14 unchanged sentences
The briefings provided to our Audit Committee and Board of Directors include updates on the Company’s key cyber risks and threats, the status of projects to strengthen our information security systems and incident readiness programs, assessments of the information security program and our key assets, as well as the emerging threat landscape.
−Removed: Our security officer, who reports to our VP of Engineering, and is a member of the senior leadership team, collaborates closely with key members of management including our Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, VP of Engineering, and SVP of Product to continuously monitor and evaluate our ongoing risk profile and mitigation strategies.
+Added: Our security officer has over a decade of management and executive level information technology experience and reports to our SVP of Engineering and Technology.
+Added: Our security officer is a member of the senior leadership team, collaborates closely with key members of management including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, SVP of Engineering and Technology, and SVP of Product to continuously monitor and evaluate our ongoing risk profile and mitigation strategies.
Our security officer also provides ad hoc updates to management on cybersecurity-related news and events and discusses any updates to our cybersecurity risk management and strategy programs as a result of these matters.
−Removed: Our security officer collaborates closely and regularly with our external consulting firm who provides a fractional Chief Information Security Officer (“CISO”), which includes a cybersecurity expert with recognized expertise and many years of experience.
+Added: Where in the past we leveraged an outside fractional Chief Information Security Officer (“CISO”), during the year we transitioned to an in-house security leadership team.
+Added: Our team includes personnel for supply chain security, governance risk and compliance and security engineering.
+Added: We continue to leverage external industry partners in key areas including penetration testing, forensics, and for our security operations center.
+Added: We use industry standard security tools across our program and reevaluate these annually as we digest the evolving threat landscape.
The Company’s overall risks and assessments are monitored via a cross functional team composed of members of senior management, security, legal, and financial reporting.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.