3 unchanged sentences
We have certain processes for identifying, assessing and managing cybersecurity risks, which are built into our overall risk management program and are designed to help protect our people, technology, products, information and operations from internal and external cyber threats and to protect the information of employees, customers, vendors, and other individuals, such as subjects enrolled in our clinical trials, from unauthorized access or attack, as well as secure our networks and systems.
−Removed: Our cybersecurity program is built upon, and we periodically assess our processes against, the National Institute of Standards and Technology, or NIST, Cybersecurity Framework Special Publication 800-53, and our incident response capabilities align with NIST 800-61, revision 2, or collectively, the NIST Framework.
+Added: Our cybersecurity program is built upon, and we periodically assess our processes against, the National Institute of Standards and Technology, or NIST, Cybersecurity Framework (CSF) 2.0, or the NIST Framework.
This does not imply that we meet any particular technical standards, specifications, or requirements of the NIST Framework, but rather only that we use these standards as a guide to help us mature our security posture in order to identify, assess, and manage cybersecurity risks relevant to our business.
7 unchanged sentences
On our management team, our Chief Financial Officer and Chief Operating Officer , or CFO and COO , leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees, customers, vendors and other individuals to address cybersecurity risks.
−Removed: Our CFO and COO has more than ten years of experience managing information technology teams of operating companies in the biotechnology industry.
−Removed: Our CFO and COO leads a cross-functional Cybersecurity Committee, consisting of executive-level leaders and other management-level individuals with the requisite skills and education, including our Executive Director IT and Cybersecurity, that assists the CFO and COO with carrying out these duties.
−Removed: The Executive Director IT and Cybersecurity has over ten years of offensive and defensive cybersecurity experience with departments of the U.S.
+Added: Our CFO and COO has more than eleven years of experience managing information technology teams of operating companies in the biotechnology industry.
+Added: Our CFO and COO has implemented and maintains a formal cybersecurity program which is led by our Director of IT Cybersecurity who has over fifteen years of offensive and defensive cybersecurity experience with departments of the U.S.
government, international alliances and small to large biopharmaceutical companies.
−Removed: Collectively, the members of our Cybersecurity Committee have notable experience in managing information security, possess the education and skills to fulfill these duties, and attend periodic trainings as necessary.
−Removed: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with periodic training, including training related to data protection, cybersecurity and incident response, and prevention and compliance, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately.
+Added: We collaborate with a third party that provides virtual Chief Information Security Officer, or Virtual CISO, services to further support our cybersecurity program.
+Added: Collectively, the individuals involved in our cybersecurity team and the Virtual CISO have notable experience in managing information security, possess the education and skills to fulfill these duties, and attend periodic trainings as necessary .
+Added: During our CFO and COO’s temporary medical leave of absence, our Director of IT Cybersecurity reports to our management team through our interim CFO , who has 10 years of experience implementing and managing enterprise resource planning, or ERP, systems and cybersecurity policies in the biotechnology industry.
+Added: In an effort to deter and detect cyber threats, we provide all employees, including part-time and temporary employees, with periodic security-awareness training, including training related to cybersecurity threats, which covers timely and relevant topics such as, but not limited to, threats from artificial intelligence, social engineering, phishing, password protection and mobile security, and educates employees on the importance of reporting all incidents immediately.
We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.