4 unchanged sentences
We store and maintain confidential financial and business information regarding us and persons with whom we do business on our information technology systems.
−Removed: We also collect and hold personally identifiable information of our employees in connection with their employment.
−Removed: In addition, we engage third-party service providers that may collect and hold personally identifiable information of our employees in connection with providing business services to us, including web hosting, accounting, payroll and benefit services.
+Added: We also collect and hold personal data of our employees in connection with their employment.
+Added: In addition, we engage third-party service providers that may collect and hold personal data of our employees in connection with providing business services to us, including web hosting, accounting, payroll and benefit services.
Cybersecurity Governance
5 unchanged sentences
The IT Team has in place documented procedures for cybersecurity response plans, which are reviewed annually or as events warrant.
−Removed: The IT Team utilizes third party security experts to provide continuous external penetration testing, conduct security reviews, and to provide a managed security operations center that does 24/7 monitoring as well as provide additional resources for threat and incident response activities.
+Added: The IT Team utilizes third party security experts to provide continuous external penetration testing, conduct security reviews, and to provide a managed security operations center that does regular monitoring as well as provide additional resources for threat and incident response activities.
Cybersecurity Risk Management and Strategy
We employ a multi-layered approach to protect our information systems from cybersecurity threats.
−Removed: We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts of potential breaches.
−Removed: All hardware within our information systems run an industry-standard anti-virus solution, and we have an established patching program in place to keep security updates current.
−Removed: Penetration testing is conducted by an outside party on a continual basis, resulting in rapid discovery and remediation of potential weaknesses.
−Removed: To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including simulated phishing attempts, multiple times per month.
+Added: We have security operations center coverage that uses an industry standard security information and event management tool to aggregate and analyze data and provide alerts of potential breaches.
+Added: Hardware within our information systems run an industry-standard anti-virus solution, and we have a patching program in place to keep security updates current.
+Added: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats.
+Added: For example, penetration testing is conducted by an outside party on a periodic basis, resulting in rapid discovery and remediation of potential
+Added: To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including regular simulated phishing attempts.
Additional training is assigned to employees as deemed necessary to reduce the risk of cybersecurity threats.
In case of a cybersecurity incident, we maintain a cybersecurity insurance policy to reduce any direct costs that could be incurred.
+Added: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies.
+Added: We have a vendor management process to manage cybersecurity risks associated with our use of these providers.
+Added: Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider.
A cybersecurity incident could interrupt our operations, result in downtime, divert our planned efforts and resources from other projects, damage our reputation and brand, damage our competitive position, subject us to liability claims or regulatory penalties under laws protecting the privacy of personal information.
Although impacts of past cybersecurity incidents have been immaterial to date , the impacts of such events in the future may materially and adversely affect our business, financial condition, or results of operations.
+Added: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1.
+Added: Risk Factors in this Annual Report, including “ A security breach or disruption to our information technology systems, or those of the third parties with whom we work, could materially adversely affect our business, financial condition, results of operations and reputation .”
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.