1 unchanged sentence
Cybersecurity
−Removed: Our cybersecurity program seeks to ensure the confidentiality, integrity, and availability of the Company’s information assets, including its critical systems.
+Added: We have developed and implemented a cybersecurity program that seeks to ensure the confidentiality, integrity, and availability of the Company’s information assets, including its critical systems.
The Company’s cybersecurity program is based on an ISO 27001 compliant Information Security Management System (ISMS).
−Removed: This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use ISO 27001 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
−Removed: Our cybersecurity program is integrated into our overall risk management program, and is used to assess cybersecurity risks as part of the Company’s enterprise risk assessment.
−Removed: Our cybersecurity program focuses on (i) raising security awareness of our employees and product development teams, and (ii) implementing and maintaining security operations that are designed to protect identities, networks, systems and data and provide for detection, response and recovery, including a cyber incident response plan.
−Removed: Our cyber incident response plan outlines a process for detecting and responding to cybersecurity incidents.
+Added: We use ISO 27001 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
+Added: Our cybersecurity program is integrated into our overall risk management program;
+Added: which is reviewed and evaluated by our Board, and shares reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial areas.
+Added: Key elements of our cybersecurity program include, but are not limited to, (i) raising security awareness of our employees and product development teams, and (ii) implementing and maintaining security operations that are designed to protect identities, networks, systems, and data and provide for detection, response, and recovery, including a cyber incident response plan.
We engage external parties to enhance our cybersecurity program and to operate a variety of operational functions.
−Removed: In accordance with the third-party’s criticality to our operations and respective risk profile, we assess and engage consultants, advisors and vendors who are recognized for their cybersecurity expertise or products to supplement, augment and/or test specific elements of our security program, such as identity management, email security, network security, system/endpoint protection and managed detection and response.
+Added: We engage consultants, advisors and vendors who are recognized for their cybersecurity expertise or products to supplement, augment and/or test specific elements of our security program.
We also engage third-party specialists to conduct security assessments and independent audits of the security of the Company’s systems and networks.
−Removed: The results of these assessments are used to help us improve our cybersecurity program.
−Removed: In February 2023, the Company adopted a third-party management policy to formalize the baseline of security controls that it expects its partners and other third-party companies to meet, in accordance with their criticality to our operations and respective risk profile, when directly interacting with the Company’s data.
−Removed: To mitigate risks that may arise from the
−Removed: Table of C ontents
−Removed: Company’s interactions with service providers, suppliers, and vendors, we strive to ensure that our systems/services are integrated with trustworthy vendors.
+Added: The results of these assessments may be used to help us improve our cybersecurity program.
+Added: The Company has adopted a third-party management policy to formalize the baseline of security controls that it expects its partners and other third-party companies (including service providers) to meet, in accordance with their criticality to our operations and respective risk profile, when directly interacting with the Company’s data.
+Added: To mitigate risks that may arise from the Company’s interactions with service providers, suppliers, and vendors, we strive to ensure that our systems/services are integrated with trustworthy vendors.
Although to date we have not experienced a material cybersecurity incident resulting in an interruption of our operations, the scope or impact of any future incident cannot be predicted with complete certainty.
−Removed: For additional information on our cybersecurity risks, see “We are subject to cybersecurity risks to operational systems, security systems, infrastructure, firmware in our lidar and customer data processed by us or third-party vendors or suppliers and any material failure, weakness, interruption, cyber event, incident or breach of security could harm our reputation and adversely affect our ability to conduct our business and we may incur significant liabilities.” in Part 1, Item 1A for more information.
+Added: For additional information on our cybersecurity risks, see “We and our third-party providers are subject to cybersecurity risks, and any material failure, weakness, interruption, cyber event, incident, or breach of security could materially adversely affect our business, results of operations, and financial condition.” in Part 1, Item 1A for more information.
Cybersecurity Governance
−Removed: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of the Company’s cybersecurity program and other information technology risks.
−Removed: The Audit Committee receives regular cybersecurity updates and reports from members of the Company’s executive team and the Director of Information, Cyber-Security and Compliance.
−Removed: The Company’s executive team monitors the activities of the breach response team (“BRT”) and where appropriate participates in and supports the BRT in the evaluation and remediation of actual or perceived cyber incidents in accordance with the Company’s incident response plan.
+Added: Our Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee oversight of the Company’s cybersecurity program.
+Added: The Audit Committee receives regular cybersecurity updates and reports from members of the Company’s executive team and the Senior Director of Information Security and Compliance and in turn briefs the full Board on these updates as part of its Committee report.
+Added: In addition, the full Board receives a full report on the Company’s cybersecurity program at least annually.
+Added: The Board is also apprised by the executive team and Senior Director of Information Security and Compliance of more significant or serious cybersecurity incidents.
+Added: The Company has a Breach Response Team (“BRT”) led by our Senior Director of Information Security and Compliance under the direction of our executive team, and is responsible for assessing and managing our material risks from cybersecurity threats.
+Added: The Senior Director of Information Security and Compliance has day to day responsibility for the Company’s cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.
+Added: Our Senior Director of Information Security and Compliance has served in various roles in information security for over 15 years, including serving as Associate Director of Cybersecurity of a public company as well as a PCI Qualified Security Assessor at a cybersecurity consulting firm.
+Added: He holds a M.S.
+Added: in Computer Science and has attained various certifications, including an Advanced Computer Certificate from Stanford University .
+Added: Our executive team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from the Senior Director of Information Security and Compliance and other internal security personnel;
+Added: threat intelligence and other information
+Added: Table of C ontents
+Added: obtained from governmental, public or private sources, including external consultants engaged by us;
+Added: and alerts and reports produced by security tools deployed in our IT environment.
+Added: The Company’s executive team also monitors the activities of the BRT and where appropriate participates in and supports the BRT in the evaluation and remediation of actual or perceived cyber incidents in accordance with the Company’s incident response plan.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.