11 unchanged sentences
We take a risk-based approach to the evaluation of third-party vendors, and apply mitigations and processes based on our evaluation of the sensitivity of the data accessed by the vendor and the maturity of the vendor’s programs.
−Removed: We use a third-party tool to assess the degree of risk posed by the vendor, and are in the process of developing a vendor security questionnaire.
−Removed: We have not identified any cybersecurity incidents or threats that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
−Removed: However, like other companies in our industry, we and our third-party vendors have from time to time experienced threats and cybersecurity incidents that could affect our information or systems.
+Added: Where our risk-based evaluation indicates the need, we use a third-party tool to assess the degree of risk posed by the vendor and use a vendor security questionnaire as part of our assessment of third-parties.
+Added: We have been subject to cybersecurity incidents in the past, including the publicly disclosed April 2024 security incident.
+Added: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents have materially affected our operations, financial systems, or financial condition.
+Added: However, there is no guarantee that past security incidents and any future incidents will not have a material impact on our operations, financial systems, or financial condition in the future.
For more information, see Item 1A.
3 unchanged sentences
Our VP of IT has 25 years experience managing IT teams, including 10 years managing IT security teams.
−Removed: Led by the VP of IT, along with our Senior Manager of IT Security, the IT leadership team meets at least annually, and more frequently as needed, to review the Company’s cybersecurity objectives and take steps to further the suitability and effectiveness of the Company’s information security program.
−Removed: The output from these meetings are reviewed periodically with senior management.
−Removed: We are also in the process of establishing a cybersecurity management committee comprised of IT, communications, finance, legal and product personnel.
+Added: Led by the VP of IT, along with our Director of IT Security, the IT leadership team reviews the Company’s cybersecurity objectives at least annually, and more frequently as needed, and takes steps to further the suitability and effectiveness of the Company’s information security program.
+Added: The output from these reviews are reported periodically to senior management.
+Added: We have also established a cybersecurity management committee comprised of IT, communications, finance, legal and product personnel.
The board and Audit Committee oversee the management of risks by the Company’s executives.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.