3 unchanged sentences
Risk Management and Strategy
−Removed: We have processes in place for assessing, identifying, and managing material risks from cybersecurity threats, which are integrated into our overall risk management processes.
−Removed: These processes include identifying and assessing risks from cybersecurity threats associated with the use of third-party service providers, if any.
−Removed: The response to any cybersecurity incident detected or reported is led by our Computer Security Incident Response Team, or the CSIRT, to assess the nature and magnitude of event and classify severity in accordance with our internal policies and procedures.
−Removed: Depending on the severity of the incident, appropriate level of management members, including our Chief Executive Officer, Chief Financial Officer, external legal counsel, and certain members of the finance and investor relations organizations, will be notified and take appropriate actions.
−Removed: In addition, the Information Technology, or IT, team provides periodic reports to the Chief Executive Officer and other members of our senior management, as appropriate, and provides periodic reports to the Audit Committee of the Board of Directors as needed.
−Removed: These reports include updates on our cyber risks and threats as well as the status of previously identified and/or reported cybersecurity incidents, if any.
−Removed: We also actively engage with key vendors,
−Removed: industry participants and intelligence and law enforcement communities as part of continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures.
−Removed: We use various tools and methodologies to assess, identify, and manage material risks from cybersecurity threats that are tested on a regular cadence.
−Removed: We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, penetration tests and use of threat intelligence feeds.
−Removed: The results of these activities and any key actions are reported at least once per quarter and more frequently as needed to the Audit Committee of the Board of Directors, our Chief Executive Officer, and key members of senior management.
−Removed: Our employees are also required to certify their understanding and completion of training for our cybersecurity policies.
+Added: We have designed and implemented a cybersecurity program which includes administrative, technical, and physical controls and processes to manage and mitigate material risks from internal and external cybersecurity threats, including but not limited to the following:
+Added: ● A team responsible for designing, implementing, and continually improving our policies, procedures, and technology.
+Added: ● A risk management process to identify, assess, and treat internal and external ( third-party ) cybersecurity risks.
+Added: ● An incident management program to effectively and efficiently identify, review, and escalate incidents with the appropriate stakeholders (e.g., CEO, CFO, Legal, Finance, and others, as required).
+Added: ● A vulnerability management program to scan and penetration test, on an ongoing basis, our systems and networks to identify and treat identified vulnerabilities.
+Added: ● A security awareness program that educates our team members on an ongoing basis on internal security policies and secure behaviors.
+Added: ● Engage with key vendors, industry participants and intelligence and law enforcement communities as part of continuing efforts to evaluate and enhance the effectiveness of our information security program.
+Added: ● Periodically reporting risks , previous and current incidents, and ways to mitigate risks to the Chief Executive Officer, the Audit Committee of the Board of Directors, and other members of senior management .
As of the date of this report, we are not aware of any material risks from cybersecurity threats , including as a result of any previous cybersecurity incidents, that have materially affected our business strategy, results of operations, or financial condition.
However, as discussed under “Risk Factors” in Part I, Item 1A of this Annual Report, cybersecurity threats pose multiple risks to us, including potentially to our results of operations and financial condition.
−Removed: Refer to Item 1A – “ Our internal computer systems, or those used by our contract research organizations or other contractors or consultants, may fail or suffer security breaches ” and “ We are dependent on information technology, systems, infrastructure and data ,” which are incorporated by reference into this Item 1C.
+Added: Refer to Item 1A – “ Our internal computer systems, or those used by our CROs or other contractors or consultants, may fail or suffer security breaches ” and “ We are dependent on information technology, systems, infrastructure and data ,” which are incorporated by reference into this Item 1C.
As cybersecurity threats become more sophisticated and coordinated, it is reasonably likely that we will be required to expend greater resources to continue to modify and enhance our protective measures as we pursue our business strategies.
8 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.