2 unchanged sentences
Risk Management and Strategy.
−Removed: We have a multi-pronged approach to assess, identify, and manage material risks from cybersecurity threats.
+Added: We have a multi-pronged approach to assess, identify, and manage material risks from cybersecurity threats that is aligned with the National Institute of Standards and Technology framework.
This approach includes system testing and patching, continuous monitoring, end-user training and awareness, multi-layered security, redundancy mechanisms, encryption, and internal audits and assessments.
Assessment of cybersecurity risk is part of our overall enterprise risk management (“ERM”) process, which is reviewed by the Audit Committee of our Board of Directors, along with our strategies for managing our cybersecurity risks.
−Removed: We maintain technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance, and business continuity mechanisms for the protection of our assets.
+Added: We maintain technical and organizational safeguards, including regular employee training and phishing simulations, incident response capability reviews and exercises, cybersecurity insurance, and business continuity mechanisms for the protection of our assets.
If faced with a cybersecurity incident, our IT team is trained to focus on responding to and containing the threat and minimizing any business impact, as appropriate.
−Removed: In the event of an incident, our IT team assesses, among other factors, safety impact, supply chain and
−Removed: manufacturing disruption, data and personal information loss, business operations disruption, projected cost, and potential for reputational harm.
+Added: In the event of an incident, our IT team assesses, among other factors, safety impact, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost, and potential for reputational harm.
From time to time, our processes are audited and validated by internal and external experts.
We leverage third-party cybersecurity experts with the goal of minimizing disruption to our business and production operations, strengthening supply chain resilience in response to cyber-related events, and supporting the integrity of IT systems.
−Removed: We also engage reputable third-party consultants to help evaluate and test our vulnerability to cybersecurity threats as well as to conduct annual penetration tests to help identify exploitable cybersecurity vulnerabilities.
+Added: We also engage reputable third-party consultants to help evaluate and test our vulnerability to cybersecurity threats as well as to conduct annual penetration
+Added: tests to help identify exploitable cybersecurity vulnerabilities.
Our IT team assesses these testing results and implements any appropriate measures to mitigate vulnerabilities identified.
+Added: We rely on various third-party service providers and a cybersecurity incident at any of our third-party service providers could materially adversely impact us.
+Added: We evaluate third-party service providers from a cybersecurity risk perspective using a range of measures, including information security and cybersecurity due diligence assessments, ongoing monitoring and evaluation of our providers, examination of available System and Organization Controls attestation reports, and inclusion security and privacy contractional provisions in our agreements with our providers.
+Added: However, we rely on our third-party service providers to implement security programs commensurate with their risk, and we cannot ensure that their efforts will be successful.
We have not experienced any material impacts from any cybersecurity threats or incidents in the last three fiscal years.
1 unchanged sentence
For more information about our risks from cybersecurity threats, see Item 1A—Risk Factors—A failure of one or more of our key information technology (“IT”) systems, networks, processes, associated sites, or service providers could have a negative impact on our business .
−Removed: Our Board of Directors is responsible for overseeing risk assessments and risk management, including cybersecurity risks, and is assisted in these efforts by the Audit Committee of the Board.
+Added: The Audit Committee of our Board of Directors is responsible for overseeing risk assessments and risk management, including cybersecurity risks.
Our IT team is responsible for assessing and managing our risks from cybersecurity threats.
−Removed: Our IT team is led by our Vice President of Information Technology and Security, who reports directly to our Chief Financial Officer.
−Removed: During 2023, our Chief Information Officer (who has been serving as our Chief Commercial Officer since January 2024) provided updates on cybersecurity threats and risks to our Board of Directors and to the Audit Committee of our Board of Directors.
+Added: Our IT team is led by our Vice President of Information Technology and Security, who reported to our Chief Financial Officer during 2024.
+Added: Our Vice President of Information Technology and Security provides updates on cybersecurity threats and risks to the Audit Committee of our Board of Directors throughout the year.
In addition, the Audit Committee reviewed cybersecurity risks and mitigation strategies in 2024 as part of their oversight of our enterprise risk management process.
1 unchanged sentence
He received both his bachelor’s and master’s degrees in information management and holds Certified Information Systems Security Professional (“CISSP”) certification.
−Removed: Our Vice President of Information Technology and Security monitors our processes for preventing, detecting, mitigating, and remediating cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of our incident response plans, which include escalation to our Chief Executive Officer and Chief Financial Officer, as appropriate.
+Added: Our Vice President of Information Technology and Security monitors our processes for preventing, detecting, mitigating, and remediating cybersecurity incidents through his management of, and participation in, the cybersecurity risk management and strategy processes described above, including through the operation of our incident response plans, which include escalation to our Interim Chief Executive Officer and Chief Financial Officer, as appropriate.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.