6 unchanged sentences
In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
−Removed: We have an Information Security Committee, assisted by a Virtual Chief Information Security Officer (the “vCISO”) which is a contracted third-party security firm whose responsibilities include the formulation, review and recommendation of information security policies, ensuring compliance with applicable information security requirements, assessing the adequacy and effectiveness of the information security policies and coordinate the implementation of information security controls, identifying and recommending how to handle an instance of non-compliance, provide clear direction and visible management support for information security initiatives, promote information security education, training, and awareness throughout the Company, and initiate plans and programs to maintain information security awareness, educate the team and staff on ongoing legal, regulatory and compliance changes as well as industry news and trends, educate the team and staff on ongoing legal, regulatory and compliance changes as well as industry news and trends, report annually, in coordination with the vCISO, to Executive Management on the effectiveness of our information security program, including progress of remedial actions.
−Removed: The Information Security Committee, which includes the vCISO, our Vice President of Information Technology (“VPIT”) and our network administrators, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery policies.
+Added: We have an Information Security Committee, which is comprised of our Vice President of Information Technology (“VPIT”) and our network administrators.
+Added: The Information Security Committee works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery policies.
To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents.
Through ongoing communications with these teams, the Information Security Committee monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Risk Management Committee when appropriate.
−Removed: The VPIT and the vCISO provide frequent reporting and updates to our executive management and provides a full report to the Audit Committee of the Board on the cybersecurity audit and its cybersecurity roadmap for improvements and new infrastructure implementations annually, or more frequently if the need arises.
−Removed: The vCISO has served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of two large public companies.
−Removed: The vCISO holds undergraduate and graduate degrees in computer science and has attained the professional certification of Certified Chief Information Security Officer.
−Removed: The VPIT holds several information technology licenses and certificates and has served in various roles in information technology for over 25 years, including experience managing risks arising from cybersecurity threats.
+Added: The Information Security Committee is assisted by a Virtual Chief Information Security Officer (the “vCISO”) which is a contracted third-party security irm whose responsibilities include the formulation, review and recommendation of information security policies, ensuring compliance with applicable information security requirements, assessing the adequacy and effectiveness of the information security policies and coordinate the implementation of information security controls, identifying and recommending how to handle an instance of non-compliance, providing clear direction and visible management support for information security initiatives, promoting information security education, training, and awareness throughout the Company, and initiating plans and programs to maintain information security awareness, educating the team and staff on ongoing legal, regulatory and compliance changes as well as industry news and trends, and reporting annually, in coordination with the vCISO, to Executive Management on the effectiveness of our information security program, including progress of remedial actions.
+Added: Our VPIT and vCISO provide frequent reporting and updates to our executive management and provides a full report to the Audit Committee of the Board on the cybersecurity audit and its cybersecurity roadmap for improvements and new infrastructure implementations annually, or more frequently if the need arises.
+Added: Our vCISO has employees and consultants that have served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of two large public companies.
+Added: Our VPIT holds several information technology licenses and certificates and has served in various roles in information technology for over 25 years, including experience managing risks arising from cybersecurity threats.
The Information Security Committee oversees our ERM process, including the management of risks arising from cybersecurity threats.
5 unchanged sentences
Anti-virus and malware endpoint protection software is used on all Company and non-Company information systems workstations and laptops, as well as email filtering protection.
−Removed: We also subscribed to a Managed Threat Response service that proactively monitors all systems.
+Added: We also subscribe to a Managed Threat Response service that proactively monitors all systems.
System event logs are produced and reviewed, with all exceptions and anomalies of actions affecting or relevant to information security identified and investigated.
+Added: The Security Operations Center from Sophos manages this service which reviews, identifies, and investigates threats in coordination with our internal teams.
Software updates and configuration changes applied to information resources are tested prior to widespread implementation and are implemented in accordance with our change control policy.
51 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.