6 unchanged sentences
To identify, assess and manage material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other company risks as part of our overall risk assessment process.
−Removed: Our enterprise risk management committee, a multidisciplinary committee that includes our Chief Financial Officer, Chief Operating Officer and Chief Technology Officer and is chaired by our General Counsel, collaborates with internal subject matter specialists in an effort to gather information for identifying, assessing and managing material cybersecurity risks, such as information related to their severity, likelihood of occurrence and potential mitigation strategies.
−Removed: At least quarterly, our Chief Information Officer and Senior Director, Information Security, meet with our enterprise risk management committee, together with the rest of our senior leadership team, to present and discuss a cybersecurity risk assessment.
+Added: Our enterprise risk management committee, a multidisciplinary committee that includes our Chief Financial & Operating Officer and Chief Revenue Officer and is chaired by our Chief Legal Officer, collaborates with internal subject matter specialists in an effort to gather information for identifying, assessing and managing material cybersecurity risks, such as information related to their severity, likelihood of occurrence and potential mitigation strategies.
+Added: At least quarterly, our Chief Information Officer and Senior Director, Information Security, meet with our enterprise risk management committee to present and discuss a cybersecurity risk assessment.
Key cybersecurity risks are then incorporated into our enterprise risk management framework.
−Removed: To help inform our cybersecurity risk identification, assessment and management, we also employ a range of tools and services, including network and endpoint monitoring, vulnerability assessments, and periodic penetration testing and tabletop exercises.
+Added: To help inform our cybersecurity risk identification, assessment and management, we also employ a range of tools and services, including network and endpoint monitoring, vulnerability assessments, periodic penetration testing, bug bounty program and tabletop exercises.
In an effort designed to provide for the availability of critical data and systems, manage our material risks from cybersecurity threats, and protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we also undertake the below listed activities:
3 unchanged sentences
• conduct phishing email simulations for personnel with access to corporate email systems in an effort to enhance awareness and responsiveness to such possible threats;
+Added: • periodically evaluate customer support interactions to help ensure compliance with security protocols and service standards;
• through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care;
9 unchanged sentences
In addition, cybersecurity considerations may affect the selection and oversight of our service providers.
−Removed: We perform diligence on certain service providers that have access to our systems, data or
−Removed: facilities that house such systems or data.
+Added: We perform diligence on certain service providers that have access to our systems, data or facilities that house such systems or data.
This diligence may include a review of the service providers’ internal and/or external security audits and certifications.
2 unchanged sentences
We have, from time to time, experienced threats to and breaches of our data and systems.
−Removed: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see Item 1A, “Risk Factors” of this Annual Report on Form 10-K.
+Added: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see Part I, Item 1A, “Risk Factors” of this Annual Report on Form 10-K.
Cybersecurity Governance
3 unchanged sentences
The audit committee receives information related to the foregoing matters from our Chief Information Officer and Senior Director, Information Security, as well as with representatives from our enterprise risk management committee.
−Removed: Our audit committee also receives an annual information security report, which contains information regarding, among other things, the data security processes and procedures that have been implemented across company business units.
+Added: audit committee also receives an annual information security report, which contains information regarding, among other things, the data security processes and procedures that have been implemented across company business units.
+Added: In addition, our full board of directors is presented with updates on our cybersecurity threat risk management and strategy processes at least annually.
Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer and Senior Director, Information Security .
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.