7 unchanged sentences
Our Chief Information Security Officer (“CISO”) reports to the board quarterly on cybersecurity matters .
−Removed: These reports and presentations are prepared with input from members of our senior management team responsible for overseeing the company’s cybersecurity risk management, including the Chief Technology Officer, Chief Financial Officer, Chief Legal Officer and Chief People Officer.
+Added: These reports and presentations are prepared with input from members of our senior management team responsible for overseeing the company’s cybersecurity risk management, including the Chief Technology Officer, Chief Financial Officer, Chief Legal Officer, Chief People Officer, and SVP, Engineering .
In addition, cybersecurity risks and associated mitigation efforts are assessed by senior management as part of the enterprise risk assessment process that includes reporting to and discussion with the audit committee and our board of directors.
In addition, cybersecurity controls have been integrated into our disclosure controls and procedures.
−Removed: Our CISO, who has extensive cybersecurity knowledge and skills gained from extensive information technology and engineering experience, heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business.
+Added: Our CISO heads the team responsible for implementing, monitoring and maintaining cybersecurity and data protection practices across our business.
+Added: Our CISO has extensive background, knowledge and skill in cybersecurity, with over 12 years of experience in establishing and maturing cybersecurity programs in the advertising technology space, from small startups to Fortune 500 companies.
+Added: She holds a bachelors degree, with a certificate in architecture and systems engineering, and a professional education certificate in AI and machine learning.
The CISO receives reports on cybersecurity threats from other internal information security personnel on an ongoing basis and in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate cybersecurity risks.
6 unchanged sentences
The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, and provides triage workflows for individuals to follow.
−Removed: Our incident response process is generally based on the NIST framework and focuses on four phases:
+Added: Our incident response process is generally based on the NIST Cybersecurity Framework and focuses on four phases:
detection and analysis;
7 unchanged sentences
All phases of the review process are led by the CISO or another member of the security team, as appropriate.
−Removed: We perform regular vulnerability scanning of our systems in order to ensure appropriate security controls are in place and function in accordance with established policies.
+Added: We perform regular vulnerability scanning of our systems in order to confirm appropriate security controls are in place and function in accordance with established policies.
We also have ongoing engagements with security consultants and other third parties as required to assist with assessing, identifying, and managing cybersecurity risks.
1 unchanged sentence
We have a robust internal controls framework and process and issue annual SOC 1 Type 2 reports covering our DV+, Streaming, and SpringServe platforms.
−Removed: In addition to our internal audit team, we have a dedicated compliance manager within the engineering department who helps ensure compliance with our control framework.
+Added: In addition to our internal audit team, we have a dedicated compliance manager within the engineering department who helps promote compliance with our control framework.
As detailed elsewhere in this Annual Report on Form 10-K, we also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, proprietary and other types of information.
We use state of the art systems with respect to the type of information processed, and employ processes designed to oversee, identify, and reduce the potential impact of a security incident with a third-party vendor or customer or otherwise implicating the third-party technology and systems we use.
−Removed: Despite ongoing efforts to continue improvement of our and our vendors’ ability to protect against cyber-attacks, we may not be able to protect all information systems.
+Added: Despite ongoing efforts to continue improvement of our and our vendors’ ability to protect against
+Added: cyber-attacks, we may not be able to protect all information systems.
Any incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences.
−Removed: Although we maintain a robust cybersecurity program, due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents.
−Removed: While we are not aware of having experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents.
+Added: Although we maintain a robust cybersecurity program, due to the evolving cybersecurity threat landscape, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents.
+Added: While we are not aware of any risks from cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents .
To mitigate against such risks, the company carries information security risk insurance that provides protection against potential losses arising from a cybersecurity incident.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.