9 unchanged sentences
In evaluating our response to our application security assessments, penetration tests and risk feeds, our team collaborates with technical and business stakeholders to further analyze the risk to the company, and form detection, mitigation and remediation strategies to enhance our current security program.
−Removed: Our security program is aligned to the National Institute of Standards and Technology Cybersecurity Framework Special Publication (NIST) 800-53 standard, and we have obtained a SOC 2 Type 2 Certification.
+Added: Our security program is aligned to the National Institute of Standards and Technology Cybersecurity Framework Special Publication 800-53 standard, and we have obtained a SOC 2 Type 2 Certification.
Although we refer to such frameworks in developing our cybersecurity risk management approaches, our use of them as guides is not intended to suggest that we meet any particular technical standards, specifications or requirements set forth therein.
−Removed: We maintain an incident response plan which includes, among other areas, prioritization guidelines, data collection and evidence handling, communication channels and partners, and if required, law enforcement engagement.
+Added: We maintain an incident response plan that includes, among other areas, prioritization guidelines, data collection and evidence handling, communication channels and partners and, if required, law enforcement engagement.
We maintain relationships with both local and national law enforcement agencies.
3 unchanged sentences
We are briefed regularly by national law enforcement, and work with external consulting firms on custom training and evaluations.
−Removed: While we have experienced cybersecurity incidents in the past, to date, none have materially affected the Company or our financial position, results of operations, or cash flows.
+Added: In addition, we regularly consider and enter into strategic transactions for the acquisition of, investment in or partnership with businesses, solutions or technologies, and therefore we conduct risk assessments with respect to such businesses, solutions or technologies and integrate them into our cybersecurity risk management program and implement the processes, assessments and plans described herein.
+Added: While we have experienced cybersecurity incidents in the past, to date, none have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.
We continue to invest in the cybersecurity and resiliency of our systems and networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain.
−Removed: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, “Risk Factors,” under the heading “If our information technology systems, data, or physical facilities, or those of third parties upon which we rely, are or were compromised, we could experience adverse business consequences resulting from such compromise,” which should be read in conjunction with the information contained within Item 1C, Cybersecurity.
+Added: Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, “Risk Factors,” under the heading “If our information technology systems, data, or physical facilities, or those of third parties upon which we rely, are or were compromised, we could experience adverse business consequences resulting from such compromise,” and additional information about risks related to our ability to successfully integrate acquired businesses, including implementing our cybersecurity risk management processes, is discussed under the headings “ Acquisitions and other strategic investments involve a number of inherent risks, any of which could result in the benefits anticipated not being realized,” and “We have experienced in the past, and could also suffer in the future, disruptions, outages, defects and other performance and quality problems with our systems, including our information technology systems, our research and development activities, our facilities, our other fixed assets or with the public cloud, internet and other infrastructure on which they rely,” in Item 1A of Part I, “Risk Factors,” each of which should be read in conjunction with the information contained within this Item 1C, Cybersecurity.
Cybersecurity Governance
−Removed: The Company’s Board of Directors oversees the overall risk management process, including cybersecurity risks, directly and through its committees.
−Removed: Our Audit Committee is responsible for the oversight of cybersecurity risks, including our assessment of potential vulnerabilities and threats, evaluation of incidents, and monitoring of the implementation of key actions and/or projects to further enhance our ability to detect and manage ongoing security threats.
+Added: The Board oversees our overall risk management process, including cybersecurity risks, directly and through its committees.
+Added: Our Audit Committee is responsible for the oversight of cybersecurity risks, including our assessment of potential vulnerabilities and threats, evaluation of incidents and monitoring of the implementation of key actions and projects to further enhance our ability to detect and manage ongoing security threats.
Key members of management, including our security officer, provide updates to our Audit Committee on at least a semi annual basis.
−Removed: In addition to committee updates, our security officer also meets with the full Board of Directors at least annually to discuss the Company’s overall risk profile and associated ongoing mitigation efforts.
−Removed: The briefings provided to our Audit Committee and Board of Directors include updates on the Company’s key cyber risks and threats, the status of projects to strengthen our information security systems and incident readiness programs, assessments of the information security program and our key assets, as well as the emerging threat landscape.
−Removed: Our security officer has over a decade of management and executive level information technology experience and reports to our SVP of Engineering and Technology.
−Removed: Our security officer is a member of the senior leadership team, collaborates closely with key members of management including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, SVP of Engineering and Technology, and SVP of Product to continuously monitor and evaluate our ongoing risk profile and mitigation strategies.
−Removed: Our security officer also provides ad hoc updates to management on cybersecurity-related news and events and discusses any updates to our cybersecurity risk management and strategy programs as a result of these matters.
−Removed: Where in the past we leveraged an outside fractional Chief Information Security Officer (“CISO”), during the year we transitioned to an in-house security leadership team.
+Added: In addition to committee updates, our security officer also meets with the full Board at least annually to discuss our overall risk profile and associated ongoing mitigation efforts.
+Added: The briefings provided to our Audit Committee and Board include updates on our key cyber risks and threats, the status of projects to strengthen our information security systems and incident readiness programs, assessments of the information security program and our key assets, as well as the emerging threat landscape.
+Added: Our Chief Information Security Officer has over a decade of management and executive level information technology experience and reports to our Chief Information Officer.
+Added: Our Chief Information Security Officer is a member of the senior leadership team, collaborates closely with key members of management including our President and Chief Executive Officer, Chief Financial Officer and Chief Operating Officer, Chief Legal Officer and Chief Administrative Officer, Chief Business Officer, Chief Information Officer, EVP of Global Engineering and Chief Product Officer to continuously monitor and evaluate our ongoing risk profile and
+Added: mitigation strategies.
+Added: Our Chief Information Security Officer also provides ad hoc updates to management on cybersecurity-related news and events and discusses any updates to our cybersecurity risk management and strategy programs as a result of these matters.
Our team includes personnel for supply chain security, governance risk and compliance and security engineering.
−Removed: We continue to leverage external industry partners in key areas including penetration testing, forensics, and for our security operations center.
+Added: We also leverage external industry partners in key areas including penetration testing, forensics and for our security operations center.
We use industry standard security tools across our program and reevaluate these annually as we digest the evolving threat landscape.
−Removed: The Company’s overall risks and assessments are monitored via a cross functional team composed of members of senior management, security, legal, and financial reporting.
+Added: Our overall risks and assessments are monitored by a cross functional team composed of members of senior management, security, legal and financial reporting.
A partnership exists between these aforementioned individuals and departments so that identified issues are addressed in a timely manner and incidents are escalated to the appropriate parties as required.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.