6 unchanged sentences
Together, we refer to these systems and data as our Information Assets, Systems, and Data .
−Removed: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, and standards and policies designed to manage and mitigate material risks from information security threats to our Information Assets, Systems, and Data, including, for example:
+Added: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from information security threats to our Information Assets, Systems, and Data, including, for example:
using manual and automated monitoring tools;
16 unchanged sentences
(2) the information security team with enterprise input from other teams, including our risk management, internal audit, security, and technology management personnel, works with management to prioritize our risk management processes and mitigate information security threats that have a higher likelihood of leading to a material impact to our business;
−Removed: (3) our global risk and compliance team, under the direction of our CISO , evaluates material risks from information security threats against our overall business objectives.
+Added: and (3) our global risk and compliance team, under the direction of our CISO , evaluates material risks from information security threats against our overall business objectives.
We use third-party service providers to assist, from time to time, in identification, assessment, and management of material risks from information security threats, including but not limited to penetration testing firms, professional services firms, external legal counsel, threat intelligence service providers, information security consultants and software providers, managed cybersecurity service providers, and forensic investigators.
1 unchanged sentence
We use certain vendor management processes to help manage information security risks associated with our use of certain of these providers.
−Removed: Depending on the nature of the services provided, the sensitivity of the Information Assets, Systems, and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify information security risks associated with a provider and impose contractual obligations related to information security on the provider, including, for example:
−Removed: conducting risk assessments and vulnerability scans related to our vendors’ services;
+Added: Depending on the nature of the services provided, the sensitivity of the Information Assets, Systems, and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify information security risks associated with a provider and impose contractual obligations related to information security on the provider, including, for example, conducting risk assessments and vulnerability scans related to our vendors’ services;
requiring our vendors to complete security questionnaires;
9 unchanged sentences
For a description of the risks from information security threats that may materially affect us and how they may do so, see Risk Factors—Risks Related to Data Privacy and Cybersecurity in Part I, Item 1A of this Annual Report on Form 10-K.
−Removed: Our information security risk assessment and management processes are implemented and maintained by certain of our management, including our CISO, our Chief Technology Officer, and our Director of Security Operations .
+Added: Our information security risk assessment and management processes are implemented and maintained by certain of our management, including our CISO, our Chief Technology Officer, and our Senior Director of Security Operations .
Our CISO has over 30 years of experience developing and leading IT product security teams across multiple technology domains, and previously held leadership positions at several large technology companies.
Our Chief Technology Officer has over 20 years of experience in various engineering and product development leadership roles, including most recently as a Corporate Vice President within a large enterprise software company, with strong background in cloud computing, distributed systems, and product development.
−Removed: Our Director of Security Operations has over 13 years of experience in IT security and is a Certified Information Systems Security Professional.
+Added: Our Senior Director of Security Operations has over 14 years of experience in IT security and is a Certified Information Systems Security Professional.
Our CISO and information security team are responsible for hiring appropriate information security personnel, helping to integrate information security risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel.
4 unchanged sentences
This committee meets regularly, as relevant, to discuss oversight of the information security program, program enhancements, and new risks or threats the company might be facing.
−Removed: The company has established, as part of its incident response program, a smaller senior executive committee to oversee and manage information security incidents or vulnerabilities, assessed by severity and/or known or threatened impact.
+Added: The company has established, as part of its incident response program, a smaller senior executive committee to oversee and manage information security incidents or vulnerabilities, assessed by severity and known or threatened impact.
Security management and others work with our incident response team to help mitigate and remediate information security incidents of which they are notified.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.