10 unchanged sentences
As part of the above processes, we engage with consultants to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.
+Added: We have adopted cybersecurity control principles based on the National Institute of Standards and Technology Cybersecurity Framework (NIST), the Center for Internet Security (CIS) and ISO 27001.
+Added: Further, our cybersecurity controls are designed to comply with applicable laws concerning protection of private information, including the EU General Data Protection Regulation (GDPR), Brazil’s Lei General de Proteção de Dados Pessoais (LGPD) and the California Consumer Privacy Act of 2018 (CCPA).
Our processes include assessing cybersecurity risks associated with our use of third-party service providers in the normal course of business, including those in our supply chain or who have access to our customer and employee data or our systems.
14 unchanged sentences
Our Board of Directors (the "Board") is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight.
−Removed: The full Board receives an update on the Company’s risks, risk management process and the risk trends related to cybersecurity at least annually, which includes a review of key performance indicators, recent threats and the Company’s management of such threats.
+Added: The full Board receives an update on the Company’s risks, risk management process and the risk trends related to cybersecurity at least annually, which includes a
+Added: review of key performance indicators, recent threats and the Company’s management of such threats.
The Audit Committee specifically assists the Board in its oversight of risks related to cybersecurity.
The Security Director and IT Director brief the Audit Committee on information security and cybersecurity annually and as necessary in response to certain incidents.
−Removed: Although risks from cybersecurity incidents and threats have to date not materially impacted us, our business strategy, results of operations or financial condition, we have from time to time and will continue to experience threats to and security
−Removed: incidents related to our and our third party vendors’ data and systems.
+Added: Although risks from cybersecurity incidents and threats have to date not materially impacted us, our business strategy, results of operations or financial condition, we have from time to time and will continue to experience threats to and security incidents related to our and our third party vendors’ data and systems.
For more information, please see “Item 1A, Risk Factors.”
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.