9 unchanged sentences
We understand that our customers, patients, and stakeholders entrust us with sensitive data, including Protected Health Information, and we take this responsibility seriously.
−Removed: Our board of directors has an important role in the oversight of the Company’s cybersecurity risk management and strategy and has delegated certain components of such oversight related to the security of and risks related to computerized information and technology systems across the company, as well as by risk area (including privacy, data security, and cybersecurity matters), to the audit committee, which regularly interacts with our Chief Information Security Officer (“CISO") and Chief Risk Officer (“CRO”).
+Added: Our board of directors has an important role in the oversight of our cybersecurity risk management and strategy and has delegated certain components of such oversight related to the security of and risks related to computerized information and technology systems across the organization, as well as by risk area (including privacy, data security, and cybersecurity matters), to the audit committee, which regularly interacts with our Chief Information Security Officer ("CISO") and Chief Risk Officer ("CRO").
We also regularly engage external parties to assist in the review of our cybersecurity risk oversight processes.
2 unchanged sentences
To identify, assess, and manage material cybersecurity risks, our Cybersecurity team uses a cybersecurity risk assessment process aligned with leading frameworks such as the National Institute of Standards and Technology’s (“NIST”) Cybersecurity Framework and HIPAA.
−Removed: To ensure appropriate and consistent risk evaluation and decision-making processes among our Cybersecurity and Global Risk & Integrity departments, we utilize an Adjusted Risk Rating (“ARR”) system that considers certain attributes that represent impact to the Company, and we prioritize our actions based on our ARR system.
+Added: To ensure appropriate and consistent risk evaluation and decision-making processes among our Cybersecurity and Global Risk & Integrity departments, we utilize an Adjusted Risk Rating (“ARR”) system that considers certain attributes that represent impact to iRhythm, and we prioritize our actions based on our ARR system.
Our cybersecurity risk assessment program provides the underlying basis for the activities our Cybersecurity and Global Risk & Integrity departments take to identify and mitigate risks from, as well as develop risk management and response strategies for, evolving and emerging cybersecurity threats.
2 unchanged sentences
On top of annual information security awareness training for our employees, we also provide focused training for certain departments.
−Removed: Our security training incorporates awareness of cyber threats (including malware, ransomware, and social engineering attacks), password hygiene, and incident reporting process, as well as physical security best practices.
+Added: Our security training incorporates awareness of cyber threats
+Added: (including malware, ransomware, and social engineering attacks), password hygiene, and incident reporting process, as well as physical security best practices.
We engage in the periodic assessment of our policies, standards, processes, and practices that are designed to address cybersecurity threats and incidents, internally and through assessments by external providers.
9 unchanged sentences
If we were to experience a material cybersecurity incident in the future, such incident may have a material effect, including on our business strategy, operating results, or financial condition.
−Removed: For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the risk factor titled “Cybersecurity risks, including those involving network security breaches, services interruptions and other incidents affecting the confidentiality, integrity or availability of our data and systems, could result in the compromise of confidential data or critical data systems and give rise to potential harm to our patients, remediation and other expenses, expose us to liability under HIPAA, breach notification laws, consumer protection laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations.”
−Removed: As described above, our board of directors has an important role in the oversight of the Company’s cybersecurity risk management and strategy, with certain components of such oversight, including matters related to the security of and risks related to computerized information and technology systems, delegated to the audit committee.
+Added: For more information regarding cybersecurity risks that we face and potential impacts on our business related thereto, see the risk factor titled “Cybersecurity risks, including those involving network security breaches, services interruptions and other incidents affecting the confidentiality, integrity or availability of our data and systems, could result in the compromise of confidential data or critical systems and give rise to potential harm to our patients, remediation costs and other expenses, expose us to liability under HIPAA, breach notification laws, consumer protection laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business and operations."
+Added: As described above, our board of directors has an important role in the oversight of our cybersecurity risk management and strategy, with certain components of such oversight, including matters related to the security of and risks related to computerized information and technology systems, delegated to the audit committee.
At the management level, our Cyber Security and Risk departments work together to monitor our cybersecurity and risk programs, reporting to our CISO and CRO, respectively.
7 unchanged sentences
The audit committee’s reviews may also include presentations by members of senior management, as well as briefings with other internal and external subject-matter experts to help broaden the board of directors’ understanding of the latest cybersecurity issues and the latest regulatory and threat landscapes.
−Removed: Additionally, the audit committee monitors our progress to address cybersecurity risks and opportunities, as well as cybersecurity incident response and recovery metrics.
+Added: Additionally, the audit committee monitors our progress to address cybersecurity risks and opportunities, as well as
+Added: cybersecurity incident response and recovery metrics.
Our management also periodically engages external service providers to conduct objective assessments of our cybersecurity program, and results of such assessments are directly reported to the audit committee .
−Removed: Finally, the audit committee reports out to the larger board of directors periodically on the company’s cybersecurity risks and posture .
+Added: Finally, the audit committee reports out to the larger board of directors periodically on our cybersecurity risks and posture .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.