6 unchanged sentences
Our management, led by our chief information officer, in conjunction with our internal management security committee and third-party service providers, helps to identify, assess and manage our cybersecurity threats and risks by monitoring and evaluating our threat environment and risk profile.
−Removed: These teams use a number of methods to do this, including manual and automated tools, internal and external threat assessments, and internal and external vulnerability assessments.
+Added: These teams use several methods to do this, including manual and automated tools, internal and external threat assessments, and internal and external vulnerability assessments.
The third parties we engage in this effort generally consist of threat intelligence service providers;
21 unchanged sentences
We have an IT vendor management program designed to identify and manage cybersecurity risks associated with our use of these providers.
−Removed: As part of this program, we typically conduct risk assessments for certain IT vendors on an annual basis, including, for example, using security assessment measures such as a security questionnaire, perform a review of the vendor’s own security program, audits, and vulnerability scans.
+Added: As part of this program, we typically conduct risk assessments for certain IT vendors on an annual basis, including, for example, using security assessment measures such as a security questionnaire, performing a review of the vendor’s own security program, audits, and vulnerability scans.
Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and may impose contractual obligations related to cybersecurity on the provider.
−Removed: Despite these measures, we may not be successful in preventing, mitigating or recovering from a cybersecurity incident, which could have a material adverse effect on our operations or financial results or reputation.
While we maintain cybersecurity insurance, it may not be adequate to cover the costs related to cybersecurity incidents we experience.
−Removed: For a description of the primary risks from cybersecurity threats that may materially affect our business and how they may do so, see Part I, Item 1A.
−Removed: Risk Factors in this Annual Report on Form 10-K, including “— Our networks and those of our third-party service providers may be vulnerable to cybersecurity risks.”
+Added: For a description of the primary risks from cybersecurity threats that may materially affect our business and how
+Added: they may do so, see Part I, Item 1A.
+Added: Risk Factors in this Annual Report on Form 10-K, including “— Cyberattacks and other security threats and disruptions could have a material adverse effect on our business.”
Our Board of Directors addresses cybersecurity risk management as part of its general oversight function.
11 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.