2 unchanged sentences
We have developed and implemented a cybersecurity program that seeks to ensure the confidentiality, integrity, and availability of the Company’s information assets, including its critical systems.
−Removed: The Company’s cybersecurity program is based on an ISO 27001 compliant Information Security Management System (ISMS).
−Removed: We use ISO 27001 as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
+Added: We use the ISO 27001 Information Security Management System (ISMS) standard as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.
Our cybersecurity program is integrated into our overall risk management program;
which is reviewed and evaluated by our Board, and shares reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial areas.
−Removed: Key elements of our cybersecurity program include, but are not limited to, (i) raising security awareness of our employees and product development teams, and (ii) implementing and maintaining security operations that are designed to protect identities, networks, systems, and data and provide for detection, response, and recovery, including a cyber incident response plan.
+Added: Key elements of our cybersecurity program include, but are not limited to, (i) raising security awareness of our employees and product development teams, and (ii) implementing and maintaining security controls and operations that are designed to protect identities, networks, systems, and data and provide for detection, response, and recovery, including a cyber incident response plan.
We engage external parties to enhance our cybersecurity program and to operate a variety of operational functions.
−Removed: We engage consultants, advisors and vendors who are recognized for their cybersecurity expertise or products to supplement, augment and/or test specific elements of our security program.
−Removed: We also engage third-party specialists to conduct security assessments and independent audits of the security of the Company’s systems and networks.
−Removed: The results of these assessments may be used to help us improve our cybersecurity program.
−Removed: The Company has adopted a third-party management policy to formalize the baseline of security controls that it expects its partners and other third-party companies (including service providers) to meet, in accordance with their criticality to our operations and respective risk profile, when directly interacting with the Company’s data.
+Added: We engage consultants, advisors and vendors who are recognized for their cybersecurity expertise or products to supplement, augment and/or test elements of our security program.
+Added: We also engage third-party specialists to conduct security assessments and independent audits of the Company’s systems and networks.
+Added: The Company has adopted a third-party management policy to formalize the baseline of security controls that it expects its partners and other third-party companies (including service providers) to meet, in accordance with their criticality to our operations and respective risk profile based on their level of access to our systems and/or data.
To mitigate risks that may arise from the Company’s interactions with service providers, suppliers, and vendors, we strive to ensure that our systems/services are integrated with trustworthy vendors.
−Removed: Although to date we have not experienced a material cybersecurity incident resulting in an interruption of our operations, the scope or impact of any future incident cannot be predicted with complete certainty.
+Added: Although to date we have not identified risks from cybersecurity threats or experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our operations, business strategy or financial condition, the scope or impact of any future incident cannot be predicted with certainty.
For additional information on our cybersecurity risks, see “We and our third-party providers are subject to cybersecurity risks, and any material failure, weakness, interruption, cyber event, incident, or breach of security could materially adversely affect our business, results of operations, and financial condition.” in Part 1, Item 1A for more information.
4 unchanged sentences
The Board is also apprised by the executive team and Senior Director of Information Security and Compliance of more significant or serious cybersecurity incidents.
−Removed: The Company has a Breach Response Team (“BRT”) led by our Senior Director of Information Security and Compliance under the direction of our executive team, and is responsible for assessing and managing our material risks from cybersecurity threats.
+Added: Table of C ontents
+Added: Our Senior Director of Information Security and Compliance under the direction of our executive team, and is primarily responsible for assessing and managing our material risks from cybersecurity threats.
The Senior Director of Information Security and Compliance has day to day responsibility for the Company’s cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.
1 unchanged sentence
He holds a M.S.
−Removed: in Computer Science and has attained various certifications, including an Advanced Computer Certificate from Stanford University .
−Removed: Our executive team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from the Senior Director of Information Security and Compliance and other internal security personnel;
−Removed: threat intelligence and other information
−Removed: Table of C ontents
−Removed: obtained from governmental, public or private sources, including external consultants engaged by us;
+Added: in Computer Science and has attained various certifications, including an Advanced Computer Security Certificate from Stanford University.
+Added: Our Senior Director of Information Security and Compliance assists the executive team by taking steps to stay informed about and monitor the Company’s efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel;
+Added: threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us;
and alerts and reports produced by security tools deployed in our IT environment.
−Removed: The Company’s executive team also monitors the activities of the BRT and where appropriate participates in and supports the BRT in the evaluation and remediation of actual or perceived cyber incidents in accordance with the Company’s incident response plan.
+Added: The Company’s executive team also monitors the activities of the Breach Response Team (“BRT”) and where appropriate participates in and supports the BRT in the evaluation and remediation of cyber and other security incidents in accordance with the Company’s incident response plan.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.