3 unchanged sentences
We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data and information related to our product candidates, preclinical studies and clinical trials, which we refer to collectively as Information Systems and Data.
−Removed: Our information technology and security, or IT, team and risk committee, together with our third-party service providers, help identify, assess and manage our cybersecurity threats and risks.
−Removed: In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company’s risk profile using a multi-faceted approach including use of automated tools, internal and external IT audits, and IT security, governance, risk and compliance reviews, reviewing reports and using services that identify cybersecurity threats, conducting threat and vulnerability assessments, and evaluating reported threats as well as the industry’s risk profile.
−Removed: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example:
+Added: Our information technology and security, or IT, management team, and legal, and risk management teams, together with our third-party service providers, help identify, assess and manage our cybersecurity threats and risks.
+Added: In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company’s risk profile using a multi-faceted approach including use of manual and automated tools, internal and external IT audits, and IT security, governance, risk and compliance reviews, reviewing reports and using services that identify cybersecurity threats, conducting threat and vulnerability assessments, evaluating reported threats as well as the industry’s risk profile, and third-party-conducted red/blue team testing and tabletop incident response exercises .
+Added: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including,
maintaining an incident response plan and policy, incident detection and response, maintaining a vulnerability management policy, maintaining disaster recovery and business continuity plans, conducting risk assessments, implementing security standards and certifications, maintaining network security controls, access controls, and physical security measures, asset management, systems monitoring, conducting proactive privacy and cybersecurity reviews of systems and applications, performing penetration testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging laws and regulations related to data protection and information security and implement appropriate changes and encrypting Information Systems and Data.
3 unchanged sentences
Additionally, our risk committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which evaluates our overall enterprise risk.
−Removed: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants and software providers, managed cybersecurity service providers, penetration testing firms and dark web monitoring services.
+Added: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms, including legal counsel, threat intelligence service providers, cybersecurity consultants and software providers, managed cybersecurity service providers and penetration testing firms .
Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers .
Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling or processing our Information Systems and Data.
−Removed: Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.
+Added: Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider, including completion of security questionnaires, review of the vendor’s written security program, review of security assessments and reports, audits, and security assessment calls with the vendor’s security personnel.
For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1.
−Removed: “Risk Factors” in this Annual Report on Form 10-K, including under the heading “ If our internal computer systems, or those used by our contract research organizations, or other contractors or consultants upon which we rely, fail, suffer security incidents, or are or were otherwise compromised, we could experience adverse consequences, including but not limited to regulatory investigations or actions;
+Added: “Risk Factors” in this Annual Report on Form 10-K, including under the heading “ If our internal computer systems, or those used by our contract research organizations, or other contractors or consultants with whom we work, fail, suffer security incidents, or are or were otherwise compromised, we could experience adverse consequences, including but not limited to regulatory investigations or actions;
fines and penalties;
9 unchanged sentences
This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives.
−Removed: Our cybersecurity risk assessment and management processes are implemented and maintained by leaders from our IT, finance and legal teams, including our Head of IT, who has experience in various roles involving information technology and cybersecurity.
+Added: Our cybersecurity risk assessment and management processes are implemented and maintained by leaders from our IT, finance and legal teams, including our Executive Director who serves as the Head of IT and Cybersecurity, who has twenty years of experience in various roles involving information technology and cybersecurity.
These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to our audit committee on any appropriate items .
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.