12 unchanged sentences
· Our business does not require us to collect personal customer information.
−Removed: We minimize other cybersecurity risks by using specialist service providers for sensitive operations such as payroll processing, credit card transactions, email, and remote data backup.
+Added: We minimize other cybersecurity risks by using specialized service providers for sensitive operations such as payroll processing, credit card transactions, email, and remote data backup.
We verify our information service providers ’ cybersecurity policies.
3 unchanged sentences
We keep our controls up-to-date.
−Removed: · Actions to correct deficiencies and reduce or eliminate vulnerabilities.
−Removed: · Written cybersecurity contingency plans.
+Added: · Actions to correct any deficiencies and reduce or eliminate vulnerabilities.
+Added: · Written cybersecurity contingency plans, including plans for various specific scenarios.
· Training and testing for all employees on cybersecurity risks, mitigation, and best practices.
−Removed: New employees are required to complete cybersecurity training and testing, and all employees must complete annual training and testing .
+Added: New employees are required to complete cybersecurity training and testing, and annual training and testing is required for all employees .
Cybersecurity Governance
4 unchanged sentences
· Regular cybersecurity reporting to the Audit Committee.
+Added: We have a full-time information technology specialist who reports directly to our CEO and is responsible for assessing and managing cybersecurity risks.
+Added: Both our information technology specialist and our CEO have extensive experience managing our cybersecurity.
+Added: We have not engaged third-party service providers for cybersecurity, because we believe it is better to have the expertise in-house.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.