2 unchanged sentences
Risk Management and Strategy
−Removed: We have developed and implemented a cybersecurity framework designed to evaluate, identify and manage risks stemming from threats to the security of our information, systems and network using a risk-based approach.
+Added: We have developed and implemented a cybersecurity framework designed to identify, detect, protect, respond to and recover from risks stemming from threats to the security of our information, systems and network using a governance-led risk-based approach.
The framework is informed, in part, by the National Institute of Standards and Technology (NIST) Cybersecurity Framework, although this does not necessarily mean that we meet all technical standards, specifications or requirements outlined in the NIST framework.
8 unchanged sentences
This includes mandatory annual cybersecurity training and monthly phishing simulations.
−Removed: We also perform periodic tabletops or simulation exercises involving technical experts and business and functional leaders.
+Added: We also perform periodic internal tabletops or simulation exercises involving technical experts, business and functional leaders, as well as separate exercises with select critical third-party service providers.
We conduct third-party assessments of potential new vendors who process, store or transmit our data, which include a formal security review.
This can include the review of documentation related to a vendor’s security attestations, such as SOC 2 Type 2 or HITRUST certifications.
−Removed: We leverage third party cybersecurity companies to periodically assess our cybersecurity program and procedures and reaffirm our compliance with SOC 2 standards.
+Added: We leverage third-party cybersecurity companies to assess our cybersecurity program and procedures and reaffirm our compliance with SOC 2 standards as well as the HIPAA Security Rule.
These assessments aid in continual improvement and help us identify and address risks from cybersecurity threats.
10 unchanged sentences
Our CISO reports to our Chief Information Officer and leads our overall cybersecurity function.
−Removed: Our CISO has over 20 years of experience in various security roles, which include managing information security, development cybersecurity strategy, and implementing cybersecurity programs.
+Added: Our CISO has over 20 years of experience in various security roles, which include managing information security, developing cybersecurity strategy, and implementing cybersecurity programs.
Our CISO collaborates with senior leaders and other members of our organization to identify and analyze cybersecurity risks and implement controls as appropriate and feasible to mitigate these risks.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.