4 unchanged sentences
Our assessment, identification and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes.
−Removed: We rely on a multidisciplinary team, including our information technology department, legal department, management, engineering operations, and third-party service providers (the “Security Function”) to help assess, identify and manage the Company’s cybersecurity threats and risks.
−Removed: Various members of the Security Function monitor and evaluate our cybersecurity threat environment using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, and evaluating threats reported to us.
−Removed: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response plan, risk assessments, incident detection and response, vulnerability management, encryption of data, network security controls, data segregation, access controls, physical security, systems monitoring, employee training, cybersecurity insurance, and asset management, tracking and disposal.
−Removed: We work with third-parties from time to time to assist us to identify, assess, and manage risks from cybersecurity threats, including, for example, professional services firms, including outside legal counsel, cybersecurity consultants, and cybersecurity software providers.
−Removed: We use certain third-party service providers to perform a variety of functions that help us operate our business, such as application providers, hosting companies, contract research organizations, distributors, and supply chain resources.
+Added: We rely on a multidisciplinary team, including our Chief Technology Officer, information technology department, legal department, security management, and engineering operations, (the “Security Function”) to help assess, identify and manage the Company’s cybersecurity threats and risks.
+Added: Various members of the Security Function monitor and evaluate our cybersecurity threat environment using various methods including, for example, using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating threats reported to us, audits, conducting threat assessments, conducting vulnerability assessments to identify vulnerabilities, use of external intelligence feeds, and internal tabletop and incident response exercises.
+Added: Depending on the environment, systems and data at issue, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, an incident response plan, risk assessments, incident detection and response, vulnerability management processes, disaster recovery/business continuity processes, encryption of data, network security controls, data segregation, access controls, physical security, systems monitoring, vendor risk management processes, employee training, penetration testing, cybersecurity insurance, dedicated cybersecurity staff, and asset management, tracking and disposal.
+Added: We work with third-parties from time to time to assist us to identify, assess, and manage risks from cybersecurity threats, including, for example, professional services firms, including outside legal counsel and penetration testing firms.
+Added: We use certain third-party service providers to perform a variety of functions that help us operate our business, such as application providers and hosting companies.
Depending on the nature of the services provided, the sensitivity and information processed, and the identity of the service provider, our vendor management process may include different levels of assessment designed to help identify cybersecurity risk associated with a provider.
Such assessments include, for example, reviewing the written security program of such provider and conducting security assessments and audits.
−Removed: As of December 31, 2024, the Company has not identified any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, but there can be no assurance that any such risk will not materially affect the Company in the future.
−Removed: See Part I, Item 1A, “Risk Factors” for a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, including the risk factor titled, If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, interruptions to our operations such as to our LungTraX Platform services or our clinical trials, claims that we breached our data protection obligations, harm to our reputation, business operations, and financial condition, as well as a loss of customers or sales.
−Removed: Our board of directors address the Company’s cybersecurity risk management as part of its general oversight function.
+Added: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see Part I, Item 1A, “Risk Factors” for a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, including the risk factor titled, If our information technology systems or data, or those of third parties with whom we work, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, interruptions to our operations such as to our LungTraX Platform services or our clinical trials, claims that we breached our data protection obligations, harm to our reputation, business operations, and financial condition, as well as a loss of customers or sales.
+Added: Our board of directors addresses the Company’s cybersecurity risk management as part of its general oversight function.
The board of directors’ Audit Committee is responsible for overseeing the Company’s cybersecurity risk management processes, including the Company’s oversight and mitigation of risks from cybersecurity threats.
−Removed: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including the Senior Director of Information Technology, who has worked in various roles responsible for securing networks and application systems, the Chief Executive Officer, the General Counsel, and the Chief Financial Officer.
+Added: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of Company management, including the Senior Director of Information Technology, who has worked in various roles responsible for securing networks and application systems, the Cloud Security Engineering Manager, the Chief Executive Officer, the Chief Technology Officer, the General Counsel, and the Chief Operating Officer and Chief Financial Officer and Chief Operation Officer.
These members of management are responsible for hiring appropriate personnel, integrating cybersecurity risk considerations into the Company’s overall risk management strategy, and communicating key priorities to relevant personnel.
They are also responsible for approving budgets, helping to prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.
−Removed: When incidents are identified, these members of management are responsible for determining whether such incidents are material and may escalate material incidents to the Audit Committee and/or investors, based on the particular circumstances.
+Added: When material incidents are identified, these members of management are responsible for determining whether such incidents are material and may escalate material incidents to the Audit Committee and/or investors, based on the particular circumstances.
The Audit Committee receives periodic updates from management concerning the Company’s significant cybersecurity threats, risks, and the processes the Company has implemented to address them.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.