2 unchanged sentences
Cybersecurity Processes and Risk Assessment
−Removed: Our cybersecurity policies and processes are overseen by the Audit Committee of our Board.
+Added: Our cybersecurity processes are overseen by the Audit Committee of our Board.
Our cybersecurity program is focused on (i) protecting confidential business, client, investor and employee information that we store or process;
6 unchanged sentences
IT Management and its team are responsible for implementing proactive and reactive measures, including our monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes, and various other technological and administrative safeguards.
−Removed: Our cybersecurity processes and systems are designed to protect against unauthorized access of information, including by cyber-attacks.
+Added: Our cybersecurity processes and systems are designed to protect against unauthorized access of information through our systems and infrastructure, including by cyber-attacks.
Our policy and processes include, as appropriate, encryption, data loss prevention technology, authentication technology, entitlement management, access control, anti-virus and anti-malware software, and transmission of data over private networks.
2 unchanged sentences
The cybersecurity-control principles that form the basis of our cybersecurity program are informed by the National Institute of Standards and Technology Cybersecurity Framework.
−Removed: Our cybersecurity program includes review and assessment by third parties of the cybersecurity processes and systems.
−Removed: These third parties assess and report on our compliance with applicable laws and regulations and our internal incident response preparedness, including benchmarking to best practices and industry frameworks and help identify areas for continued focus and improvement.
+Added: Our cybersecurity program is periodically reviewed and assessed, including benchmarking to best practices and industry frameworks, which allows us to identify areas for continued focus and improvement.
Annual penetration testing of our network, including critical systems and systems that store confidential or sensitive information, is conducted with third party consultants and vulnerabilities are reviewed and addressed by IT Management.
When we engage vendors and other third-party partners who will have access to sensitive data or client systems and facilities, our infrastructure technology team assesses their cybersecurity programs and processes.
−Removed: We also provide our employees with cybersecurity awareness training at onboarding and annually, as well as interim security reminders and alerts.
+Added: We also provide our employees with cybersecurity awareness training at onboarding and annually.
We conduct regular phishing tests and provide additional training as appropriate.
−Removed: We have a process designed to assess the cybersecurity risks associated with the engagement of third-party vendors.
−Removed: This assessment is conducted on the basis of, among other factors, the types of services provided and the extent and type of data accessed or processed by a third-party vendor.
Governance and Oversight of Cybersecurity Risks
−Removed: We have developed an incident response framework to identify, assess, manage and report cybersecurity events, which is managed and implemented by our Cyber Risk Operating Committee (the “C-ROC”), a cross-functional management committee that includes our General Counsel, Chief Operating Officer, Chief Compliance Officer and IT Management.
+Added: We have developed an incident response framework to identify, assess, manage and report cybersecurity events, which is managed and implemented by our Cyber Risk Operating Committee (the “C-ROC”), a cross-functional management committee that includes our General Counsel, Chief Operating Officer, Global Chief Compliance Officer and IT Management.
The incident response framework determines when the C-ROC should provide notifications regarding certain cybersecurity incidents, with different severity thresholds triggering notifications to different recipient groups, including senior members of management, our Audit Committee or our Board.
The C-ROC is responsible for gathering information with respect to a cybersecurity incident, assessing its severity and potential responses, as well as communicating with senior management and the Audit Committee or full Board, as appropriate.
−Removed: This framework contemplates conducting simulated cybersecurity incident response exercises with members of senior management on an interim basis in coordination with external cyber counsel.
Our cybersecurity program, which is overseen by the C-ROC, is managed by IT Management as part of its responsibility for enterprise-wide cybersecurity strategy, policies, implementing our monitoring and alert response processes, vulnerability management, changes made to our critical systems, including software and network changes and various other technological and administrative safeguards.
−Removed: The team is led by our Chief Technology Officer , who has over 25 years of experience advising
−Removed: on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and our Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls.
−Removed: The C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of our cybersecurity program.
−Removed: Our Board has delegated the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity risk, to the Audit Committee .
−Removed: Our Chief Technology Officer periodically reports to the Audit Committee as well as the full Board, as appropriate, on cybersecurity matters.
+Added: The team is led by our Chief Technology Officer , who has over 25 years of experience advising on technology strategy, including digital transformation, cybersecurity, business analytics and infrastructure, and our Head of Technology Infrastructure, who has over 20 years of experience in the information technology field with a focus on IT risk governance and management, information security, incident response capabilities and assessing effectiveness of controls.
+Added: C-ROC meets regularly and forms cross-enterprise teams, as needed, to manage and implement key policies and initiatives of our cybersecurity program.
+Added: Our Board has delegated the primary responsibility for oversight and review of controls and procedures with respect to risk assessment and risk management, including cybersecurity risk, to the Audit Committee .
+Added: Periodically and as needed, o ur Global Chief Compliance Officer updates our Board on actions taken by the C-ROC and our Chief Technology Officer reports to our Board on cybersecurity matters.
Such reporting includes updates on our cybersecurity program, the external threat environment and our programs to address and mitigate the risks associated with the evolving cybersecurity threat environment.
−Removed: These reports also include updates on our preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents .
+Added: These reports also include, as appropriate, updates on our preparedness, prevention, detection, responsiveness and recovery with respect to cyber incidents .
Impact of Cybersecurity Risks
1 unchanged sentence
While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, we describe whether and how future incidents could have a material impact on our business strategy, results of operations or financial condition in “Item 1A.
−Removed: Risk Factors—Risks Related to Our Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships.
−Removed: ” and “Item 1A.
−Removed: Risk Factors—Risks Related to Our Legal and Regulatory Environment—Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products.
−Removed: ” Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events.
+Added: Risk Factors—Risks Related to Our Operations—Cybersecurity risks and cyber data security incidents could adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information and confidential information in our possession and damage to our business relationships” and “Item 1A.
+Added: Risk Factors—Risks Related to Our Legal and Regulatory Environment—Increased data protection regulation may result in increased complexities and risk in connection with the operation of our business and our products.” Additionally, although we have insurance coverage for cybersecurity events, there can be no assurance that we will be able to maintain our insurance coverage or it will be enough to cover the cost associated with one or more cybersecurity events.
See “Item 1A.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.