1 unchanged sentence
Cybersecurity
+Added: Risk Management and Strategy
nCino has implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks.
−Removed: Our approach includes (i) nCino’s Enterprise Risk Management Program, as managed by the Internal Audit & Enterprise Risk Management Department and overseen by the Audit Committee of the Board;
+Added: Our approach includes (i) nCino’s Enterprise Risk Management Program, as managed by the Internal Audit & Enterprise Risk Management Department and overseen by the Audit Committee of the Board, who provide formal oversight of our cybersecurity risk;
(ii) cybersecurity risk and threat assessments;
4 unchanged sentences
Within this process, we routinely assess risks that could affect the organization’s ability to meet its business objectives and provide reliable services to our customers.
−Removed: nCino’s Chief Information Security Officer ("CISO") is responsible for identifying, assessing, and managing material cybersecurity risks.
−Removed: nCino’s CISO brings over 25 years of experience in security and risk management to the Company, reporting to executive leadership, cybersecurity-focused committees, and nCino’s Board of Directors.
nCino conducts annual cybersecurity risk and threat assessments which include detailed control analyses for measuring both inherent and residual risk factors.
1 unchanged sentence
Our annual risk assessment, aligned to ISO 27001 and National Institute of Standards and Technology (“NIST”), is the basis for security risk identification, with additional assessments to address risks that threaten the achievement of established control objectives.
−Removed: Threats to security, confidentiality, and availability are identified and assessed as part of our annual and routine risk assessments .
+Added: Threats to security, confidentiality, and availability
+Added: are identified and assessed as part of our annual and routine risk assessments and regularly evaluated through internal audits.
+Added: We supplement internal efforts with independent third-party assessments and annual compliance audits, including SOC 1, SOC 2, and ISO 27001 certifications.
+Added: The results of these audits are reviewed by management and our Audit Committee, with any identified gaps or recommendations incorporated into our remediation tracking and monitoring process.
Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A of this Annual Report on Form 10-K, “Risk Factors.”
−Removed: nCino’s CISO reports cyber security risk assessment results at the Enterprise Risk Management Committee, Information Security, and Board and Audit Committee Meetings.
+Added: nCino’s Chief Information Security Officer (“CISO”) is responsible for identifying, assessing, and managing material cybersecurity risks.
+Added: nCino’s CISO brings over 25 years of experience in security and risk management to the Company, reporting to our Information Security Committee, comprised of executive leadership, cybersecurity-focused committees, and to nCino’s Board of Directors.
+Added: The CISO provides quarterly reports to the Audit Committee and annual briefings to the full Board of Directors.
+Added: nCino’s CISO reports cybersecurity risk assessment results at the Enterprise Risk Management Committee, Information Security, and Board and Audit Committee Meetings.
nCino uses formal and informal education and training efforts to identify and mitigate cybersecurity risk, which includes external collaboration with peers and industry groups.
nCino maintains a documented process for when and by whom senior management is informed of a cybersecurity incident and when such information will be reported to affected parties.
+Added: To further mitigate the impact of any cybersecurity incidents, we maintain cybersecurity insurance in amounts that we believe are appropriate for our business.
These processes are detailed within our Incident Response Plan which is regularly reviewed and updated by the information security team.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.