5 unchanged sentences
In doing so, they identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company’s risk profile using a multi-faceted approach including use of manual and automated tools, internal and external IT audits, and IT security, governance, risk and compliance reviews, reviewing reports and using services that identify cybersecurity threats, conducting threat and vulnerability assessments, evaluating reported threats as well as the industry’s risk profile, and third-party-conducted red/blue team testing and tabletop incident response exercises.
−Removed: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including,
+Added: We implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example:
maintaining an incident response plan and policy, incident detection and response, maintaining a vulnerability management policy, maintaining disaster recovery and business continuity plans, conducting risk assessments, implementing security standards and certifications, maintaining network security controls, access controls, and physical security measures, asset management, systems monitoring, conducting proactive privacy and cybersecurity reviews of systems and applications, performing penetration testing using external third-party tools and techniques to test security controls, conducting employee training, monitoring emerging laws and regulations related to data protection and information security and implement appropriate changes and encrypting Information Systems and Data.
24 unchanged sentences
Our Chief Financial Officer is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.
−Removed: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer, Chief Operating Officer, General Counsel and Head of Human Resources.
+Added: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Financial Officer and General Counsel.
Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.