6 unchanged sentences
In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
−Removed: We have an Information Security Committee, which is comprised of our Vice President of Information Technology (“VPIT”) and our network administrators.
+Added: We have an Information Security Committee , which is comprised of our Senior Vice President of Information Technology (“SVPIT”), our Director of IT Operations, our Security Specialist and our network administrators .
The Information Security Committee works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery policies.
1 unchanged sentence
Through ongoing communications with these teams, the Information Security Committee monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Risk Management Committee when appropriate.
−Removed: The Information Security Committee is assisted by a Virtual Chief Information Security Officer (the “vCISO”) which is a contracted third-party security irm whose responsibilities include the formulation, review and recommendation of information security policies, ensuring compliance with applicable information security requirements, assessing the adequacy and effectiveness of the information security policies and coordinate the implementation of information security controls, identifying and recommending how to handle an instance of non-compliance, providing clear direction and visible management support for information security initiatives, promoting information security education, training, and awareness throughout the Company, and initiating plans and programs to maintain information security awareness, educating the team and staff on ongoing legal, regulatory and compliance changes as well as industry news and trends, and reporting annually, in coordination with the vCISO, to Executive Management on the effectiveness of our information security program, including progress of remedial actions.
−Removed: Our VPIT and vCISO provide frequent reporting and updates to our executive management and provides a full report to the Audit Committee of the Board on the cybersecurity audit and its cybersecurity roadmap for improvements and new infrastructure implementations annually, or more frequently if the need arises.
+Added: The Information Security Committee is assisted by a Virtual Chief Information Security Officer (the “vCISO”) which is a contracted third -party security firm whose responsibilities include the formulation, review and recommendation of information security policies, ensuring compliance with applicable information security requirements, assessing the adequacy and effectiveness of the information security policies and coordinate the implementation of information security controls, identifying and recommending how to handle an instance of non-compliance, providing clear direction and visible management support for information security initiatives, promoting information security education, training, and awareness throughout the Company, and initiating plans and programs to maintain information security awareness, educating the team and staff on ongoing legal, regulatory and compliance changes as well as industry news and trends, and reporting annually, in coordination with the vCISO, to Executive Management on the effectiveness of our information security program, including progress of remedial actions.
+Added: Our SVPIT and vCISO provide frequent reporting and updates to our executive management and provides a full report to the Audit Committee of the Board on the cybersecurity audit and its cybersecurity roadmap for improvements and new infrastructure implementations annually, or more frequently if the need arises.
Our vCISO has employees and consultants that have served in various roles in information technology and information security for over 25 years, including serving as the Chief Information Security Officer of two large public companies.
13 unchanged sentences
Missing software updates are evaluated and updates that pose an unacceptable risk to us are implemented and installed to the relevant information resources.
−Removed: Penetration testing and vulnerability scans of the internal network, external network, and hosted applications is conducted at scheduled intervals and after any significant changes to the information system environment.
+Added: Penetration testing and vulnerability scans of the internal network, external network, and hosted applications are conducted at scheduled intervals and after any significant changes to the information system environment.
Any exploitable vulnerabilities found during a penetration test are remediated and the systems re-tested to verify vulnerabilities are resolved.
47 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.