1 unchanged sentence
CYBERSECURITY
−Removed: Cyber criminals are becoming more sophisticated and effective every day, and they are increasingly targeting enterprise software companies.
−Removed: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs.
−Removed: To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing the data customers and other stakeholders entrust to us a top priority.
+Added: We take a comprehensive approach to cybersecurity risk management.
+Added: While securing the data customers and other stakeholders entrust to us is a top priority, we, like all companies, are subject to threats of breaches of our cybersecurity programs.
Our board of directors (the “Board”) and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component.
As described in more detail below, we have established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats.
−Removed: We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure.
−Removed: There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective.
+Added: We have devoted significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments in our data and cybersecurity infrastructure.
+Added: There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective as cyber criminals are becoming more sophisticated and effective every day and increasingly targeting enterprise software companies.
Although our Risk Factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date.
27 unchanged sentences
These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness.
−Removed: For example, in 2022 and 2023, we conducted independent cyber audits to assess our controls against the NIST Cybersecurity Framework.
+Added: For example, in 2022, 2023 and 2024 we conducted independent cyber maturity assessments to review our controls against the NIST Cybersecurity Framework.
The results of significant assessments are reported to management, the Board and Audit Committee.
−Removed: Cybersecurity processes are adjusted based on the information provided from these assessments.
+Added: Cybersecurity processes are adjusted, as appropriate, based on the information provided from these assessments.
We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our customers entrust to us.
1 unchanged sentence
Our Board, in coordination with the Audit Committee, oversees our management of cybersecurity risk.
−Removed: They receive regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities.
−Removed: Our Audit Committee directly oversees our cybersecurity program.
−Removed: The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.
+Added: They receive regular reports from management about the prevention, detection, mitigation, and remediation of material information security risks, including cybersecurity incidents and vulnerabilities.
+Added: Our Audit Committee is responsible for overseeing our cybersecurity program.
+Added: The Audit Committee receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, third-party compliance certifications, control maturity assessments, and relevant ServiceNow, customer and industry cybersecurity incidents.
Management’s Role
−Removed: Our chief information officer (“CIO”), chief information security officer (“CISO”), chief technology officer (“CTO”), and General Counsel have primary responsibility for assessing and managing material cybersecurity risks and are members of management’s Security Steering Committee (the “Security Committee”), which is a governing body that drives alignment on security decisions across the Company.
+Added: The following individuals have primary responsibility for assessing and managing cybersecurity risks:
+Added: • Chief customer officer (“CCO”), who oversees the digital transformation, digital technology and security functions
+Added: • Chief digital information officer (“CDIO”), who oversees enterprise-wide digital transformation
+Added: • Chief information security officer (“CISO”), who oversees the security function and reports to the CCO
+Added: • Chief technology officer (“CTO”), who oversees product engineering and advanced technologies
+Added: • General Counsel, who oversees the legal and compliance functions
+Added: These individuals, among others, also serve as members of management’s Security Steering Committee (the “Security Committee”), which is a governing body that drives alignment on security decisions across the Company.
The Security Committee meets quarterly to review security performance metrics, identify security risks, and assess the status of approved security enhancements.
The Security Committee also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.
−Removed: Our CIO has served in various roles in information technology and information security for over 20 years, including serving as the Chief Information Officer or Chief Technology Officer of three other public companies.
+Added: Our CCO has served in various roles in information technology and information security for over 20 years, including serving as our Chief Information Officer (“CIO”) and either the Chief Technology Officer or CIO of three other public companies.
He holds an undergraduate degree in computer engineering.
−Removed: Our CISO has served in various roles in information technology and information security for almost 20 years, including serving as the Chief Information Security Officer or Chief Security Officer at two other large public companies.
+Added: Our CDIO has served in various roles in information technology for over 20 years, including serving as our Senior Vice President of Digital Technology Experience and in similar senior roles at two other public companies.
+Added: Our CISO has served in various roles in information technology
+Added: and information security for almost 20 years, including serving as the Chief Information Security Officer or Chief Security Officer at two other large public companies.
He holds an undergraduate and master’s degree in computer science.
Our CTO has served in various roles in information technology for over 25 years and has been with us since 2011.
−Removed: Our General Counsel has over 20 years of experience managing risks, including risks arising from cybersecurity threats, at several large publicly-traded technology companies.
+Added: Our General Counsel has over 20 years of experience managing risks, including risks arising from cybersecurity threats, at several large public technology companies.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.