1 unchanged sentence
CYBERSECURITY.
−Removed: We have implemented a layered cybersecurity program to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems, networks, and data systems.
+Added: We have implemented a layered cybersecurity program to assess, identify, and manage risks from cybersecurity threats to our information systems, networks, and data systems.
Our cybersecurity program is generally aligned with the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework.
Information Security Team and Governance.
−Removed: The Audit Committee has the primary responsibility of assisting our Board of Directors in overseeing risk related to cybersecurity matters.
−Removed: The Board and/or the Audit Committee receive quarterly cybersecurity-related reports from our Chief Information Officer (CIO), which may address a wide range of topics, such as:
−Removed: cybersecurity strategy, the threat environment, the status of ongoing information security program initiatives, and information security program metrics.
+Added: The Audit Committee has the primary responsibility of assisting our Board of Directors in overseeing risks related to cybersecurity matters.
+Added: The Board and the Audit Committee receive quarterly cybersecurity-related reports from our Chief Information Officer (“CIO”), that address several topics, including cybersecurity strategy, the threat environment, the status of ongoing information security program initiatives, and information security program metrics.
Additionally, we have documented protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported to the Board and/or the Audit Committee.
At the management level, our CIO, who reports directly to the CEO, has over 20 years of experience serving in IT management, software development, and technology-based roles across a variety of industries, including publishing, media and entertainment, and financial and insurance services.
−Removed: Our Chief Information Security Officer (CISO), who reports directly to the CIO, has extensive cybersecurity knowledge and skills gained from over 15 years of work experience serving in security roles for the Company and a variety of financial service firms.
−Removed: Our CISO is responsible for understanding, managing, and communicating cybersecurity risk internally to our management, and works closely with Legal to oversee compliance with legal, regulatory, and contractual security requirements.
+Added: Our Chief Information Security Officer (“CISO”), who reports directly to the CIO, has extensive cybersecurity knowledge and skills gained from over 25 years of work experience serving in executive security roles and in a variety of industries such as telecommunications, enterprise service companies, and healthcare.
+Added: Our CISO is responsible for understanding, managing, and communicating cybersecurity risk internally to our management, and works closely with our Legal & Compliance team to oversee compliance with legal, regulatory, and contractual security requirements.
Our CISO heads the Information Security Team, which is responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business.
The Information Security Team covers a wide range of cyber and information security responsibilities.
−Removed: Our CISO also receives reports on cybersecurity threats on an ongoing basis and regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks.
+Added: Our CISO also receives reports on cybersecurity threats on an ongoing basis and
+Added: regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks.
In addition to our internal capabilities, we also engage external consultants, legal counsel, or other third-party advisors to assist with assessing, identifying, and managing cybersecurity risks.
2 unchanged sentences
We have implemented a risk-based, cross-functional approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents.
−Removed: Our cybersecurity program uses a layered strategy, relying on technology and human processes to safeguard our client’s data at all layers.
+Added: Our cybersecurity program uses a layered strategy, relying on technology and human processes to safeguard our client’s data.
We embed controls within our business processes and technology development, starting with design and engineering and extending to operations.
−Removed: Our defense-in-depth strategy utilizes numerous layers of security controls, processes, and procedures across our information systems and networks, including but not limited to, vulnerability management, multi-factor authentication (MFA), identity access management (IAM), endpoint security, mobile security, application security, encryption,
−Removed: network security, web security, and event monitoring and logging.
−Removed: Aspects of our program undergo several independent third-party audits and reviews on a regular basis.
+Added: Our defense-in-depth strategy utilizes numerous layers of security controls, processes, and procedures across our information systems and networks, including but not limited to, vulnerability management, multi-factor authentication (MFA), identity access management (IAM), privileged access management (PAM), endpoint security, mobile security, application security, encryption, network security, cloud security, web security, and event monitoring and logging.
+Added: Aspects of our program undergo several annual independent third-party audits and reviews, and are part of continuous bug bounty and responsible disclosure programs.
+Added: We regularly review and update our cybersecurity program to address emerging threats and maintain alignment with industry best practices.
We maintain a written Information Security Policy, which establishes the foundational components of our cybersecurity program and our high-level security responsibilities over all technologies, facilities and data.
1 unchanged sentence
Additionally, we have adopted a documented Incident Response Plan that applies in the event of a cybersecurity incident to provide a standardized framework for response.
−Removed: In general, our incident response process follows the NIST 800-61 framework and focuses on four phases:
+Added: Our incident response process generally follows the NIST 800-61 framework and focuses on four phases:
detection and analysis;
8 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.