8 unchanged sentences
Our risk management process also encompasses cybersecurity risks associated with our use of third-party service providers.
+Added: This process involves evaluating their infrastructure security policies and controls to ensure high levels of code quality.
Following these risk assessments, we design, implement, and maintain reasonable safeguards to minimize the identified risks;
2 unchanged sentences
and monitor the effectiveness of our safeguards.
−Removed: We have allocated adequate resources and have designated high-level personnel, including our Chief Information Security Officer, to manage the cybersecurity risk assessment and mitigation process.
+Added: We follow the Critical Security Controls, or CIS, guidance to defend our systems and networks against the most prevalent cyber-attacks.
+Added: We have allocated adequate resources and have designated executives and IT management personnel to manage the cybersecurity risk assessment and mitigation process.
+Added: We track quarterly Risk Register scores, which are derived from assessments of impact and likelihood, and monitor adoption rates of CIS controls to gauge our progress.
+Added: These metrics are systematically tracked and reported to the board on a quarterly basis.
As part of our overall risk management program, we regularly provide required training to employees at all levels and in all departments on cybersecurity.
+Added: Our Cyber Security Operations Control center integrates feeds from all key areas of our infrastructure (email, network, endpoint, identity, firewall) into a centralized security information event management, or SIEM, system.
+Added: This system is integrated with our Incident Response Plan, or IRP, which provides a process for responding to different types of cybersecurity incidents and designates responsibilities and actions to be taken in responding to such incidents.
+Added: The IRP aims to eradicate problems as quickly as possible, while gathering actionable intelligence, restoring business functions, improving detection, and preventing reoccurrence.
+Added: It includes guidelines for determining incident type, severity, roles and responsibilities, and escalation points.
+Added: Furthermore, we perform regular third-party security penetration testing and cyber tabletop exercises with key stakeholders to simulate responding to a hypothetical cybersecurity incident.
+Added: We contract with third-party security monitoring services , performing active, automated searches of indexed darknet databases.
+Added: Additionally, we perform quarterly vulnerability scans against our network infrastructure and systems exposed to the Internet.
The Company also participates in a cybersecurity risk insurance policy.
2 unchanged sentences
Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our executive officers are responsible for the day-to-day management of the material risks we face.
−Removed: Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as through the Cybersecurity Committee of the Board of Directors (the “Cybersecurity Committee”).
Members of the Cybersecurity Committee are appointed by, and serve at the discretion of, the Board.
1 unchanged sentence
Each member has a working familiarity and/or experience with cybersecurity, IT strategy, IT development and deployment, or IT risk assessment and management, including information security management.
−Removed: Our Chief Information Security Officer and the Cybersecurity Committee are primarily responsible to assess and manage material risks from cybersecurity threats.
−Removed: Our Chief Information Security Officer has twenty-five years of cybersecurity experience, has completed a Masters in Information Security Engineering, and holds several cybersecurity certifications.
−Removed: Our Chief Information Security Officer and the Cybersecurity Committee oversee key cybersecurity policies and processes, including those described in “Risk Management and Strategy” above.
−Removed: Our Chief Information Security Officer and the Cybersecurity Committee are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.
−Removed: Our Chief Information Security Officer and representatives from the Cybersecurity Committee provide quarterly briefings to the Audit Committee of the Board regarding our company’s cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing.
+Added: Our executives and IT management and the Cybersecurity Committee are primarily responsible to assess and manage material risks from cybersecurity threats.
+Added: Our executives and IT management and the Cybersecurity Committee oversee key cybersecurity policies and processes, including those described in “Risk Management and Strategy” above.
+Added: Our executives and IT management and the Cybersecurity Committee are informed about policies and processes to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.
+Added: Our cybersecurity risk management is overseen by a senior IT executive with ten years of cybersecurity experience, which includes both Fortune 500 and large semiconductor companies, and thirty-five years of experience in various technology domains, such as IT Infrastructure, Cloud, Cybersecurity, and Application Development.
+Added: Our executives and IT management and representatives from the Cybersecurity Committee provide quarterly briefings to the Audit Committee of the Board regarding our company’s cybersecurity risks and activities, including but not limited to any recent cybersecurity incidents and related responses, and any cybersecurity systems testing.
The Audit Committee provides regular updates to the Board on relevant information regarding cybersecurity.
−Removed: In addition, our Chief Information Security Officer and representatives from the Cybersecurity Committee provide annual briefings to the Board on cybersecurity risks, related mitigation, and other related responses and activities.
−Removed: The last known cybersecurity breach occurred in 2020.
+Added: In addition, our executives and IT management and representatives from the Cybersecurity Committee provide annual briefings to the Board on cybersecurity risks, related mitigation, and other related responses and activities.
The Company has not experienced any material cybersecurity breach in the years ended December 31, 2024, 2023 and 2022.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.