5 unchanged sentences
Additionally, we maintain a Systems and Organization Controls (SOC) 2 Type 2 attestation.
−Removed: Our goal is to maintain an information technology infrastructure that implements physical, administrative, and technical controls.
+Added: Our goal is to maintain an information technology infrastructure that implements physical, administrative, and technical controls and is supplemented by a strong culture of security across the organization.
These controls are adjusted based on risk and designed to protect the confidentiality, integrity, and availability of our information systems, including the customer information, personal information, and proprietary information stored on our networks.
1 unchanged sentence
When a cybersecurity incident occurs, we have cross-functional teams that are responsible for leading the initial assessment of priority and severity.
−Removed: Our information security team assists in taking any remedial action in response to an incident, and external experts may also be engaged as appropriate.
+Added: Our information security team assists in taking remedial action in response to an incident, and external experts may also be engaged as appropriate.
Our overarching approach to cybersecurity risk management centers on governance, people, processes, and technology.
−Removed: We provide security awareness training to help employees understand their information protection and cybersecurity responsibilities.
+Added: We provide security awareness training to help employees understand their role in protecting our information.
This includes mandatory annual cybersecurity training and monthly phishing simulations.
We also perform periodic internal tabletops or simulation exercises involving technical experts, business and functional leaders, as well as separate exercises with select critical third-party service providers.
−Removed: We conduct third-party assessments of potential new vendors who process, store or transmit our data, which include a formal security review.
−Removed: This can include the review of documentation related to a vendor’s security attestations, such as SOC 2 Type 2 or HITRUST certifications.
−Removed: We leverage third-party cybersecurity companies to assess our cybersecurity program and procedures and reaffirm our compliance with SOC 2 standards as well as the HIPAA Security Rule.
−Removed: These assessments aid in continual improvement and help us identify and address risks from cybersecurity threats.
+Added: We conduct third-party assessments of potential new vendors who process, store or transmit our data.
+Added: This includes a formal security review which may consist of review of documentation related to a vendor’s security attestations, such as SOC 2 Type 2 or HITRUST certifications.
+Added: We leverage third-party auditing companies to assess our cybersecurity program and procedures and reaffirm our NIST CSF Maturity level, our compliance with SOC 2 standards as well as the HIPAA Security Rule.
+Added: These assessments aid in continual improvement of our program and help us identify and address cybersecurity related risks.
We also consider cybersecurity, along with our other top risks, within our enterprise risk management framework.
5 unchanged sentences
Risk Factors” for more information about our cybersecurity-related risks.
−Removed: The Quality and Compliance Committee of our Board of Directors provides board-level oversight of cybersecurity risk.
−Removed: As part of its oversight role, the Quality and Compliance Committee receives reports about our practices, programs, or notable threats or incidents related to cybersecurity throughout the year, including through periodic updates from our CISO and other leaders.
−Removed: The Quality and Compliance Committee provides regular reports to the full Board about these matters and other areas within its responsibility, and the CISO and other leaders provide updates regarding cybersecurity matters to the full Board as appropriate.
+Added: The Quality, Technology and Compliance Committee (“QTCC”) of our Board of Directors provides board-level oversight of cybersecurity risk.
+Added: As part of its oversight role, the QTCC receives reports about our practices, programs, or notable threats or incidents related to cybersecurity throughout the year, including through periodic updates from our CISO and other leaders.
+Added: The QTCC provides regular reports to the full Board about these matters and other areas within its responsibility, and the CISO and other leaders provide updates regarding cybersecurity matters to the full Board as appropriate.
Our CISO reports to our Chief Information Officer and leads our overall cybersecurity function.
2 unchanged sentences
The CISO also supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, including by collaborating with internal and external stakeholders.
−Removed: Our CISO is supported by a management-led Security Council, which consists of our Chief Executive Officer, Chief Financial Officer and other senior leaders throughout our organization, and which reviews and discusses our cybersecurity program as well as emerging cyber risks, threats, and industry trends, among other topics.
+Added: Our CISO is supported by a management-led Security Council, which consists of our Chief Executive Officer, Chief Financial Officer and other senior leaders throughout our organization.
+Added: The Security Council reviews and discusses our cybersecurity program as well as emerging cyber risks, threats, and industry trends, among other topics.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.