4 unchanged sentences
On a regular basis we implement into our operations these cybersecurity processes, technologies and controls to assess, identify and manage material risks.
−Removed: Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures.
+Added: Specifically, we engage a third-party information technology and cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures.
Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.
4 unchanged sentences
• conduct regular phishing email simulations for all employees.
−Removed: Our incident response plan coordinates the activities that we and our third-party cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations.
−Removed: T able of Contents
+Added: Our incident response plan coordinates the activities that we and our third-party information technology and cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain and remediate an incident, as well as to comply with potentially applicable legal obligations.
As part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement and compliance.
2 unchanged sentences
In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.
−Removed: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks.
+Added: Our Audit Committee of the Board is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks.
Members of the Board regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.
+Added: Our management is responsible for assessing and managing our material risks from cybersecurity threats.
+Added: Management has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information technology and cybersecurity personnel and our third-party vendors.
+Added: Our management team supervises efforts to prevent, detect and mitigate cybersecurity risks and incidents through various means, which may include briefings from both internal and external information technology and cybersecurity personnel, threat intelligence and other information obtained from governmental, public or private sources as well as alerts and reports produced by security tools deployed in our information technology environment.
As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected us, or are reasonably likely to materially affect, our business strategy, results of operations or financial position.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.