4 unchanged sentences
Cybersecurity Program
−Removed: Given the importance of cybersecurity to our business, we maintain a cybersecurity program to support the effectiveness of our systems and our preparedness for information security risks.
−Removed: This program includes a number of administrative, physical, and technical safeguards.
−Removed: We have conducted and continue to conduct evaluations of our cybersecurity program through periodic external audits and penetration tests.
−Removed: We also require cybersecurity trainings when onboarding new employees, contractors and other workforce members, as well as annual cybersecurity awareness training for our employees, contractors and other workforce members.
−Removed: Our program is based on industry frameworks, including the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”) to strengthen our program effectiveness and reduce cybersecurity risks.
−Removed: We use a risk-based approach with respect to our use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of the data accessed, processed, or stored by such third-party service provider and performing additional risk screenings and procedures, as appropriate.
−Removed: We use a number of means to assess cyber risks related to our third-party service providers, including collecting vendor questionnaires and conducting due diligence in connection with onboarding new vendors.
−Removed: We also collect and assess cybersecurity audit reports and other supporting documentation when available and include appropriate security terms in our contracts where applicable as part of our oversight of third-party providers.
+Added: We rely on a combination of internally-managed systems and third-party technology environments to support our research, clinical, commercial, and corporate operations.
+Added: As our business has grown, these systems have become increasingly important to our ability to operate effectively.
+Added: We therefore maintain a cybersecurity program designed to
+Added: support the resilience of our information systems and help prepare for evolving information security risks.
+Added: Our program includes administrative, physical, and technical safeguards and is informed by industry frameworks, including the National Institute of Standards and Technology Cybersecurity Framework.
+Added: We periodically evaluate aspects of our cybersecurity program through risk-based external assessments.
+Added: We assess cybersecurity risks as part of our broader risk-management processes and consider potential impacts on our operations, financial results and reputation.
+Added: Cybersecurity training is required when onboarding new employees, and we also provide annual cybersecurity awareness training for employees.
+Added: We use a risk-based approach with respect to our evaluation and oversight of third-party service providers that takes into account whether such service providers access, process or store our information or support key business operations.
+Added: Our due diligence activities may include security questionnaires, reviews of available audit reports and other supporting documentation.
+Added: We also include appropriate security terms in contracts with third-party service providers, where applicable.
Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats
−Removed: In the event of a cybersecurity incident, we maintain an incident response program.
−Removed: Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat;
+Added: We maintain written information security policies, including an incident response program that outlines processes for identifying, assessing, escalating, and responding to cybersecurity incidents.
+Added: Designated personnel are responsible for assessing the severity of an incident and associated threat;
containing the threat;
remediating the threat, including recovery of data and access to systems;
−Removed: analyzing any reporting obligations associated with the incident and performing post-incident analysis.
−Removed: We have relationships with a number of third-party service providers to assist with cybersecurity monitoring, containment and remediation efforts.
+Added: and evaluating any applicable legal or regulatory reporting obligations.
+Added: Our incident response program also provides for post-incident review.
+Added: We maintain 24/7 security monitoring through a managed detection and response (“MDR”) provider.
+Added: We recently expanded our cybersecurity capabilities by adding contracted personnel dedicated to security operations and incident response.
+Added: These personnel operate under the direction of our Cybersecurity and Chief Information Security Officer ("CISO") within the cybersecurity program overseen by our Chief Information Officer ("CIO"), and work alongside our MDR provider and other third-party specialists.
Management Oversight
−Removed: Our controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Information Technology (“IT”) Security and Risk Committee, which consists of our Chief Information Officer (“CIO”) and internal and third-party cybersecurity professionals.
−Removed: Our CIO has more than 25 years of experience as an IT professional overseeing and supporting IT operations in the biopharmaceutical industry, including several years of experience in cybersecurity .
−Removed: The members of the IT Security and Risk Committee also have expertise in cybersecurity.
−Removed: The IT Security and Risk Committee is responsible for the day-to-day management of our cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure that the cybersecurity program functions effectively in the face of evolving cybersecurity threats.
−Removed: Our CIO provides regular briefings to our senior management team on cybersecurity matters, including threats, events and program enhancements.
+Added: Overall responsibility for our information technology and cybersecurity functions resides with our CIO .
+Added: Our CIO has more than 25 years of experience as an information technology ("IT") professional overseeing and supporting IT operations in the biopharmaceutical industry, including several years of experience in cybersecurity.
+Added: Our CISO has over 25 years of experience in IT and security, including more than a decade in the pharmaceutical sector focused on protecting intellectual property and proprietary data.
+Added: Our CISO is responsible for the development and execution of our cybersecurity strategy and for overseeing the day-to-day operation of our cybersecurity program, which is carried out by a combination of internal and contracted cybersecurity resources supporting security operations and incident response.
+Added: In this role, the CISO, together with the CIO, oversees our processes for the prevention, detection, mitigation, and remediation of cybersecurity incidents through established policies, procedures, and reporting mechanisms, and provides regular updates to senior management and the Audit Committee of our Board of Directors (the "Audit Committee"), which oversees cybersecurity-related risk.
Board Oversight
−Removed: While our board of directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters.
−Removed: The Audit Committee is responsible for reviewing, discussing with management and overseeing our data privacy, information technology and security and cybersecurity risk exposures, including:
−Removed: (i) the potential impact of those exposures on the Company’s business, financial results, operations and reputation;
−Removed: (ii) the programs and steps implemented by management to monitor and mitigate any exposures;
−Removed: (iii) our information governance and cybersecurity
−Removed: policies and programs and (iv) major legislative and regulatory developments that could materially impact our data privacy and cybersecurity risk exposure.
−Removed: On a quarterly basis, our General Counsel, Chief Financial Officer (“CFO”) and CIO report to the Audit Committee on information technology and cybersecurity matters, including, as appropriate, key risks, a detailed threat assessment relating to information technology risks, as applicable, the potential impact of those exposures on our business, financial results, operations and reputation, the programs and steps implemented by management to monitor and mitigate exposures and any major legal developments that could significantly impact our cybersecurity risk exposure.
+Added: Our Board of Directors has overall responsibility for risk oversight, and the Audit Committee oversees cybersecurity-related risk .
+Added: The Audit Committee receives reports quarterly, and otherwise as needed, from the CISO and CIO and reviews cybersecurity matters with management, including our cybersecurity risk profile and the steps taken to monitor and mitigate cybersecurity risks.
Cybersecurity Risks
−Removed: Our cybersecurity risk management processes are integrated into our overall Enterprise Risk Management (“ERM”) process.
−Removed: As part of our ERM process, department leaders identify, assess and evaluate risks impacting our operations across our organization, including those risks related to cybersecurity.
+Added: We assess cybersecurity risks as part of our broader risk-management processes and consider potential impacts on our operations, financial results, and reputation.
+Added: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity incidents that impact our systems, networks and technology.
While we believe we maintain an effective cybersecurity program, the techniques used to infiltrate IT systems continue to evolve.
Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures.
−Removed: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our systems, networks and technology.
−Removed: To date, there have not been any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations or financial condition.
−Removed: See the section titled "Risk Factors—General Risk Factors—A failure of our information technology infrastructure and cybersecurity threats may adversely affect our business and operations." in this Annual Rep ort for more information.
+Added: To date, there have not been any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.
+Added: See the section titled "Risk Factors—General Risk Factors—A failure of our information technology infrastructure and cybersecurity threats may adversely affect our business and operations." in this Annual Report for more information.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.