4 unchanged sentences
We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, including risks relating to disruption of technology infrastructure and business operations, intellectual property theft, fraud, harm to employees or customers, violation of privacy laws and confidentiality, other litigation and legal risks, and reputational risk, as part of our overall risk management principles and processes.
−Removed: 32 | MercadoLibre, Inc.
Our risk management framework includes several security pillars, including data security, identity management, cloud security, infrastructure security, application security, incident response, and cybersecurity risk management.
+Added: We conduct annual International Organization for Standardization Information Security Management Systems ("ISMS") Requirements ("ISO/IEC 27001") reviews and Payment Card Industry Data Security Standard ("PCI-DSS") reviews of our payment information security controls with the assistance of an external certified auditor.
Our cybersecurity risk management processes incorporate frameworks aligned with recognized cybersecurity and cyber risk established frameworks.
13 unchanged sentences
and penetration testing, red team exercises and a bug bounty program to help us evaluate the effectiveness of our information security processes and improve our security measures and planning.
−Removed: We also conduct, with the assistance of an external auditor, annual Payment Card Industry Data Security Standard (PCI-DSS) reviews of our payment information security controls.
We also have teams in place to oversee and manage our cybersecurity risk management processes, including:
(i) an information security team, organized around our various services and products, responsible for day-to-day cybersecurity matters related to the respective services and products;
−Removed: (ii) a risk committee, comprised of members of management, that oversees the Company’s financial and non-financial risks, including cybersecurity risks, and assists management in oversight;
+Added: (ii) a risk committee that is comprised of members of management and oversees the Company’s financial and non-financial risks, including cybersecurity risks, as described in more detail below under the heading “Governance”;
and (iii) internal local, corporate and strategic crisis management teams that form part of our crisis management framework.
4 unchanged sentences
See “Risk Factors” in Item 1A of this Annual Report on Form 10-K for more information on our cybersecurity-related risks.
+Added: 36 | MercadoLibre, Inc.
The cybersecurity risk management processes described above are managed by our Cybersecurity VP under the supervision of the risk committee.
The Audit Committee of the board of directors provides additional oversight as needed.
−Removed: Our risk committee is comprised of the Chief Financial Officer, Commerce Executive VP, Fintech President and the Heads of Corporate Affairs, Risk & Compliance, Data Privacy, Information Security, AML & Sanctions, Legal & Government Relations, Commerce Product Development, Fintech Product Development and IT Infrastructure.
−Removed: Its primary purpose is to assist management and the board directly and/or indirectly through the board’s Audit Committee, overseeing the Company’s financial and non-financial risks, including cybersecurity risks.
−Removed: Our Cybersecurity VP and some of our risk committee members are skilled in technology, security and/or risk and compliance.
−Removed: Our Cybersecurity VP is a certified information systems security professional (CISSP) and has considerable experience in the field of information security, fraud and prevention.
+Added: Our risk committee is comprised of the Chief Financial Officer, Commerce President, Fintech President and the Heads of Corporate Affairs, Risk & Compliance, Data Privacy, Information Security, AML & Sanctions, Legal & Government Relations, Commerce Product Development, Fintech Product Development and IT Infrastructure.
+Added: The primary purpose of the risk committee is to assist management and the board, either directly or indirectly through the board’s Audit Committee, with their oversight of the Company’s financial and non-financial risks, including cybersecurity risks.
+Added: Our Cybersecurity VP and certain other members of our risk committee are skilled in technology, security and/or risk and compliance.
+Added: Our Cybersecurity VP is a certified information systems security professional and has considerable experience in the field of information security, fraud and prevention.
As part of our cybersecurity risk management processes, our Cybersecurity VP presents security risk matters to the risk committee on an as-necessary basis and to the Audit Committee annually and on an as-necessary basis.
−Removed: In the event of a critical incident that may impact the Company’s operations, the Company’s crisis management framework activates the strategic crisis management team for evaluation and response.
−Removed: The strategic crisis management team is comprised of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Commerce Executive VP, Fintech President, Corporate Affairs Executive VP and Marketing Executive VP.
−Removed: The risk committee also meets quarterly and presents the status, evolution and main indicators of each security risk to management, although information security may not be deemed a risk in each particular quarter.
−Removed: Further, the Company’s cybersecurity processes are formally evaluated by the Cybersecurity VP on an annual basis, which includes updating the Company’s cybersecurity policy, security risk management policy and methodology, and classification of information.
−Removed: 33 | MercadoLibre, Inc.
+Added: The risk committee also meets quarterly and presents to management the status, evolution and main indicators of each principal security risk, although information security may not be deemed a risk in each particular quarter.
+Added: In the event of a critical cybersecurity incident, the Company’s crisis management framework activates the cross-functional crisis management team, which, depending on the circumstances, is comprised of the Chief Executive Officer, Chief Financial Officer, Chief Operating Officer, Commerce President, Fintech President, Corporate Affairs Executive VP, Marketing Executive VP and the Cybersecurity VP.
+Added: This group works with the incident response team to help to evaluate, contain, eradicate and, if necessary, recover from the incident.
+Added: The Company’s cybersecurity processes are formally evaluated by the Cybersecurity VP on an annual basis, which includes updating the Company’s cybersecurity policy, security risk management policy and methodology, and classification of information.
Board of directors
1 unchanged sentence
To fulfill this responsibility, the Audit Committee, assisted, as appropriate, by the risk committee, oversees the risk management framework, including risk assessment and risk management policies and procedures established by management to identify, evaluate, measure and manage existing and potential cybersecurity risks faced by the Company.
−Removed: Annually and on an as-necessary basis, members of management and/or of the risk committee provide presentations to the Audit Committee regarding cybersecurity matters, including any material risks.
+Added: Annually and on an as-necessary basis, individual members of management and/or of the risk committee provide presentations to the Audit Committee regarding cybersecurity matters, including any material risks.
These presentations include information regarding cybersecurity risks, the evolution of those risks and initiatives to optimize and improve the processes of cybersecurity.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.