Unresolved Staff Comments
−Removed: There are no material unresolved written comments that were received from the SEC staff 180 days or more before the end of our 2024 fiscal year relating to our periodic or current reports under the Securities Exchange Act of 1934, as amended.
+Added: There are no material unresolved written comments that were received from the SEC staff 180 days or more before the end of our 2025 fiscal year relating to our periodic or current reports under the Exchange Act.
Cybersecurity
7 unchanged sentences
Our information security department maintains a risk register of individual risks from cybersecurity threats.
−Removed: Our CISO and CIO periodically review the area of cybersecurity risk management within our overall enterprise risk management program and work with our executive director of internal audit and enterprise risk management to incorporate the aggregate risks from the cybersecurity threat risk register into the overall enterprise risk management program risk register.
−Removed: In addition, our CISO and CIO report significant increases to our threat profile to the Information Security Governance Committee (described below).
−Removed: • We use third parties, including professional services, incident response and managed security firms (including some that we have on a pre-paid retainer basis), to assist us from time to time to identify, assess, and manage cybersecurity risks, perform threat assessments relating to our Information Systems and Data by reviewing our business and industry vertical threat profiles and applying those to the overall threat landscape, perform penetration tests, conduct cybersecurity readiness exercises, assess program maturity, and to assist in the event of a cyber security incident.
−Removed: • We have third-party vendor management processes designed to help us identify, assess and manage risks from cybersecurity threats to our Information Systems and Data that may arise out of our use of third-party vendors across our business, including, among others, application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources.
+Added: Our CISO and CDO periodically review the area of cybersecurity risk management within our overall enterprise risk management program and work with our executive director of internal audit and enterprise risk management to incorporate the aggregate risks from the cybersecurity threat risk register into the overall enterprise risk management program risk register.
+Added: In addition, our CISO and CDO report significant increases to our threat profile to the Information Security Governance Committee (described below).
+Added: • We use third parties, including professional services, incident response and managed security firms (including some that we have on a pre-paid retainer basis), to assist us from time to time to identify, assess, and manage cybersecurity risks, perform threat assessments relating to our Information Systems and Data by reviewing our business and industry vertical threat profiles and applying those to the overall threat landscape, perform penetration tests, conduct cybersecurity readiness exercises, assess program maturity, and to assist in the event of a cybersecurity incident.
+Added: • We have third-party vendor management processes designed to help us identify, assess and manage risks from cybersecurity threats to our Information Systems and Data that may arise out of our use of third-party vendors across
+Added: our business, including, among others, application providers, hosting companies, contract research organizations, contract manufacturing organizations, distributors, and supply chain resources.
Depending on the nature of the services and the service provider, our vendor management processes may include assessment of the cybersecurity practices of such vendors and contractually imposing obligations on the provider.
−Removed: For a description of the risks from cybersecurity threats that may materially affect us and how those risks may affect us see “ Significant disruptions of information technology systems or data security breaches could adversely affect our business” under Part I, Item 1A.
+Added: For a description of the risks from cybersecurity threats that may materially affect us and how those risks may affect us see “ Significant disruptions of information technology systems or data security incidents could adversely affect our business” under Part I, Item 1A.
Risk Factors in this Annual Report on Form 10-K.
1 unchanged sentence
The Audit Committee helps oversee our cybersecurity risk management processes, including oversight of risks from cybersecurity threats.
−Removed: • The Information Governance Security Committee and the Audit Committee receive various reports from CISO and CIO.
−Removed: The CISO (or its designee) reports to the Audit Committee on cybersecurity risk on at least a quarterly basis.
+Added: • The Information Security Governance Committee and the Audit Committee receive various reports from CISO and CDO.
+Added: The CISO (or their designee) reports to the Audit Committee on cybersecurity risk on at least a quarterly basis.
Written reports and presentation materials regarding cybersecurity risk provided to the Audit Committee are made available to the board of directors and they can discuss the materials and cybersecurity risk with the Audit Committee members.
The Internal Audit team oversees internal controls implemented by us under our information security program.
−Removed: • Our information security program is implemented and maintained by certain of our management, including the CISO, CIO and other members of our Information Security Governance Committee (Chief Legal Officer, Chief Financial Officer, and Chief Privacy Officer).
+Added: • Our information security program is implemented and maintained by certain of our management, including the CISO, CDO and other members of our Information Security Governance Committee (Chief Legal Officer, Chief Financial Officer, and Chief Ethics & Compliance Officer).
+Added: Our CISO has served in various cybersecurity roles for over 25 years across multiple companies and industry verticals including banking, consulting, e-commerce, and pharmaceuticals, and is a Certified Information Systems Security Professional .
+Added: In addition, our CDO, who has oversight of our cybersecurity program, has served in various information technology roles for over 25 years across multiple companies and industry verticals including publishing and pharmaceuticals.
• The Information Security Governance Committee helps assess and manage our cybersecurity risks and monitor the effectiveness of our information security program and risk management.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.