Unresolved Staff Comments
−Removed: Not Applicable.
Cybersecurity
2 unchanged sentences
As provided in the charter of the audit committee of our board of directors (“Audit Committee”), our Audit Committee serves a key function in our board of directors’ oversight of these risks and processes.
−Removed: Our Chief Information Security Officer (“CISO”) provides updates on the cybersecurity risks we face and our processes to address those risks to our Audit
−Removed: Committee on a periodic, but at least quarterly, basis.
+Added: Our Chief Information Security Officer (“CISO”) provides updates on the cybersecurity risks we face and our processes to address those risks to our Audit Committee on a periodic, but at least quarterly, basis.
These updates may include, but are not limited to, reports of identified cybersecurity risks, status of our risk management processes, and updates regarding regulatory requirements and policies.
Our Audit Committee comprises members of our board of directors with extensive experience in the technology sector who have held leadership positions at other publicly listed companies and have expertise in various aspects of our business.
−Removed: Cybersecurity matters are formally raised to the Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer through their attendance of Audit Committee meetings.
+Added: Cybersecurity matters are formally raised to our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer through their attendance of Audit Committee meetings.
These individuals are also informed of significant events and updates through direct communication from our CISO as needed.
−Removed: We have a process for significant decisions over the Company’s cybersecurity framework and identified incidents to be escalated to the board of directors for disclosure and oversight.
+Added: We have a process for significant decisions over identified incidents to be escalated to our board of directors for disclosure and oversight.
Our CISO leads our cybersecurity initiatives and is primarily responsible for the assessing, managing, and monitoring of the Company’s cybersecurity risks.
1 unchanged sentence
His knowledge of cybersecurity, compliance, and risk assessment has been leveraged to develop our cybersecurity governance and risk strategy.
−Removed: Our CISO oversees the Security Operations and Trust team, as well as our cybersecurity related programs and matters, which are reported on regularly to the Audit Committee.
+Added: Our CISO oversees our Security Operations and Trust team, as well as our cybersecurity related programs and matters, which are reported on regularly to our Audit Committee.
Cybersecurity Risk Management and Strategy
4 unchanged sentences
For example, independent third-party experts and assessors assist with our SOC 2 Type 2 examinations and penetration testing.
−Removed: Our internal audit function also periodically conducts an assessment of different systems to provide the Audit Committee with information on our cybersecurity risk management processes.
−Removed: We have implemented a process to address identified risks from cybersecurity threats in which the Security Operations and Trust team works in consultation with management and other key stakeholders, as appropriate, to determine the associated risks, potential impact, and the recommended course of action to address those risks.
−Removed: We have an incident response plan that is designed to set out escalation procedures for informing management and other key stakeholders.
−Removed: Our process calls for significant incidents and significant cyber risks to be raised to the Audit Committee followed by notification to our board of directors.
+Added: Our internal audit function also periodically conducts an assessment of different systems to provide our Audit Committee with information on our cybersecurity risk management processes.
+Added: We have implemented a process to address identified risks from cybersecurity threats in which our Security Operations and Trust team works in consultation with management and other key stakeholders, as appropriate, to determine the associated risks, potential impact, and the recommended course of action to address those risks.
+Added: We have an incident response plan that includes escalation procedures for informing management and other key stakeholders.
+Added: Our process calls for significant incidents and significant cyber risks to be raised to our Audit Committee followed by notification to our board of directors.
We engage third-party service providers in the operation of our business.
2 unchanged sentences
To monitor and manage third-party risk, we have a dedicated Security Operations and Trust team that reviews service providers’ independent attestation reports and third-party certifications.
−Removed: While we have been the target and victim of cyberattacks by third parties, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that may have materially affected or are reasonably likely to
−Removed: materially affect the Company, including our business strategy, results of operations, or financial condition.
+Added: While we have been the target and victim of cyberattacks by third parties, as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incidents that may have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.
See the section titled “Risk Factors” for further detail on identified risks, including those related to cybersecurity.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.