10 unchanged sentences
Our information security department maintains a risk register of individual risks from cybersecurity threats.
−Removed: Our Chief Information Security Officer, or CISO, and Chief Information Officer, or CIO, periodically review the area of cybersecurity risk management within our overall enterprise risk management program and work with our executive director of internal audit and enterprise risk management to incorporate the aggregate risks from the cybersecurity threat risk register into the overall enterprise risk management program risk register.
+Added: Our CISO and CIO periodically review the area of cybersecurity risk management within our overall enterprise risk management program and work with our executive director of internal audit and enterprise risk management to incorporate the aggregate risks from the cybersecurity threat risk register into the overall enterprise risk management program risk register.
In addition, our CISO and CIO report significant increases to our threat profile to the Information Security Governance Committee (described below).
• We use third parties, including professional services, incident response and managed security firms (including some that we have on a pre-paid retainer basis), to assist us from time to time to identify, assess, and manage cybersecurity risks, perform threat assessments relating to our Information Systems and Data by reviewing our business and industry vertical threat profiles and applying those to the overall threat landscape, perform penetration tests, conduct cybersecurity readiness exercises, assess program maturity, and to assist in the event of a cyber security incident.
−Removed: • We have third-party vendor management processes designed to help us identify, assess and manage risks from cybersecurity threats to our Information Systems and Data that may arise out of our use of third-party vendors across
−Removed: our business, including, among others, application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources.
+Added: • We have third-party vendor management processes designed to help us identify, assess and manage risks from cybersecurity threats to our Information Systems and Data that may arise out of our use of third-party vendors across our business, including, among others, application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources.
Depending on the nature of the services and the service provider, our vendor management processes may include assessment of the cybersecurity practices of such vendors and contractually imposing obligations on the provider.
2 unchanged sentences
• Our board of directors addresses our cybersecurity risk management as part of its general oversight function.
−Removed: The audit committee of the board of directors, or Audit Committee, helps oversee our cybersecurity risk management processes, including oversight of risks from cybersecurity threats.
+Added: The Audit Committee helps oversee our cybersecurity risk management processes, including oversight of risks from cybersecurity threats.
• The Information Governance Security Committee and the Audit Committee receive various reports from CISO and CIO.
3 unchanged sentences
• Our information security program is implemented and maintained by certain of our management, including the CISO, CIO and other members of our Information Security Governance Committee (Chief Legal Officer, Chief Financial Officer, and Chief Privacy Officer).
−Removed: Our CISO has been at the company for over 7 years, and has served in various cybersecurity roles for over 20 years across multiple companies and industry verticals including banking, consulting, ecommerce, and pharmaceuticals.
−Removed: He is a Certified Information Systems Security Professional and has experience responding to major information security incidents at previous companies prior to joining the company.
−Removed: Our CIO has been at the company and had oversight of our cybersecurity for over 7 years.
−Removed: In addition, our CIO has served in various information technology roles in the U.S.
−Removed: and overseas for over 25 years across multiple companies and industry verticals including consulting, healthcare, and pharmaceuticals.
• The Information Security Governance Committee helps assess and manage our cybersecurity risks and monitor the effectiveness of our information security program and risk management.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.