2 unchanged sentences
Risk management and strategy
−Removed: We have implemented and maintain information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical networks, third-party hosted services, communications systems, hardware, software, and data, including intellectual property and confidential, proprietary, or sensitive information, such as customer data (“Information Systems and Data”).
−Removed: Our President, Product and Technology (“President of P&T”), Chief Data Officer (“CDO”), Chief Security Officer (“CSO”), and others in our cybersecurity and audit functions, help identify, assess, and manage cybersecurity threats and risks that may impact us or our business and operations.
−Removed: We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods, including using manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating threats reported to us, coordinating with law enforcement, conducting audits and threat and vulnerability assessments, using external intelligence feeds, conducting table top exercises, and operating a bug bounty program.
−Removed: Depending on the environment, we implement and maintain various technical, physical, and organizational measures designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including appropriate measures suggested by security standards, an incident response plan, incident detection and response, vulnerability management process, disaster recovery/business continuity plans, risk assessments, data encryption, network security controls, access controls, physical security, vendor risk management program, employee training, penetration tests, cybersecurity insurance, and dedicated cybersecurity staff.
−Removed: Our assessment and management of material risks from cybersecurity threats are integrated into our overall enterprise risk management processes and consider principles from recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards.
−Removed: In general, we seek to address cybersecurity risks through a cross-functional approach that is designed to preserve the confidentiality, security, and availability of the information that we collect and store by identifying, preventing, and mitigating cybersecurity incidents when they occur.
−Removed: From time to time, we use third-party providers to assist us with identifying, assessing, and managing material risks from cybersecurity threats, including professional services firms, threat intelligence service providers, cybersecurity consultants, penetration testing firms, and forensic investigators.
−Removed: We use third-party providers for various aspects of our business, such as data-hosting companies.
−Removed: We have a third-party risk management program to manage cybersecurity risks associated with our use of these providers, which includes vendor risk assessments, questionnaires, review of the vendor’s security program, and contractual obligations for vendors, depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.
−Removed: For a description of the risks from cybersecurity threats that may materially affect us, see our risk factors under the heading “Risk Factors” in Part I of this Annual Report on Form 10-K, including the risk factor titled “If our IT systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.”
−Removed: Our Board oversees our enterprise risk management program, including the management of risks arising from cybersecurity threats.
−Removed: The audit committee of our Board (the “Audit Committee”) is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.
−Removed: A cross-functional cybersecurity committee (the “Cybersecurity Committee”), which is comprised of members of our management team, reports to the Audit Committee.
−Removed: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our President of P&T, CDO, and CSO.
+Added: We maintain an information security program designed to identify, assess, and manage material risks arising from cybersecurity threats to our critical networks, third-party hosted services, communications systems, hardware, software, and data, including intellectual property and confidential, proprietary, or sensitive information, such as customer data.
+Added: Our President, Product and Technology (“President of P&T”), Chief Data Officer (“CDO”), the senior-most employee responsible for cybersecurity management, and other members of our cybersecurity and audit teams, help identify, assess, and manage cybersecurity threats and risks that may affect our business and operations.
+Added: To help us in assessing these threats, we use various methods, including, as applicable, using a combination of manual and automated tools, subscribing to threat reports and external intelligence feeds, conducting vulnerability assessments and penetration tests, collaborating with law enforcement, and operating a bug bounty program.
+Added: Depending on the environment, systems, and data, we employ various technical, physical, and organizational measures designed to mitigate material cybersecurity risks, including an incident response plan, incident detection and response processes, a vulnerability management program, disaster recovery/business continuity plans, risk assessments, data encryption, network and access controls, a vendor risk management program, physical security, employee training, cybersecurity insurance, and dedicated cybersecurity staff.
+Added: In maintaining these measures, we consider certain principles from recognized frameworks, such as those published by the Committee of Sponsoring Organizations of the Treadway Commission, the International Organization for Standardization, and other applicable industry standards.
+Added: Our approach to addressing cybersecurity risk is cross-functional and is designed to preserve the confidentiality, integrity, and availability of data by identifying, preventing, and mitigating cybersecurity incidents.
+Added: From time to time, we engage third-party service providers, including professional services firms, threat intelligence services, cybersecurity consultants, penetration testing firms, and forensic investigators, to assist with identifying, assessing, and managing cybersecurity risks.
+Added: We also rely on data-hosting companies and other third parties for certain business operations.
+Added: We mitigate the associated cybersecurity risks through a third-party risk management program, which may include vendor risk assessments, security questionnaires, reviews of vendor security programs, and contractual obligations for vendors to maintain specific security measures.
+Added: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under the heading “Risk Factors” in Part I of this Annual Report on Form 10-K , including the risk factor titled “If our IT systems or data, or those of third parties with which we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.”
+Added: Our Board oversees our enterprise risk management program, including cybersecurity risk.
+Added: The audit committee of our Board (the “Audit Committee”) is responsible for oversight of our cybersecurity risk management processes, and a cross-functional cybersecurity committee (the “Cybersecurity Committee”), which is comprised of members of our management team, reports to the Audit Committee.
+Added: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our President of P&T, CDO, and the senior-most
+Added: employee responsible for cybersecurity management.
Our President of P&T has over 25 years of experience in senior executive roles that involved ownership of, and accountability for, cybersecurity matters, including Chief Information Officer, Chief Technology Officer, and Senior Vice President / General Manager.
1 unchanged sentence
Prior to that, she held various leadership roles at a computer software company.
−Removed: Our CSO has over 30 years of experience in computer science and engineering disciplines, and served as the Chief Information Security Officer at various companies prior to joining Procore.
−Removed: Members of our management team, including our President of P&T, CDO, and CSO, are responsible for hiring appropriate personnel, approving budgets, helping to integrate cybersecurity considerations into our risk management strategy, communicating key priorities, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security-related reports.
−Removed: We provide regular training for personnel regarding cybersecurity threats, which are intended to equip them with tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.
−Removed: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including to our President of P&T, CDO, and CSO.
−Removed: Our President of P&T, CDO, and CSO work with our incident response team to help us mitigate and remediate cybersecurity incidents, as applicable.
−Removed: Our incident response and vulnerability management processes include reporting to the Audit Committee and the Cybersecurity Committee, as appropriate.
−Removed: The Audit Committee receives periodic reports from management concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.
−Removed: The Cybersecurity Committee receives periodic reports from members of our cybersecurity team regarding such threats, risks, and processes.
−Removed: The Audit Committee and the Cybersecurity Committee also receive various reports, summaries, and presentations related to cybersecurity threats, risk, and mitigation.
+Added: Members of our management team, including our President of P&T, CDO, and the senior-most employee responsible for cybersecurity management, lead our cybersecurity assessment and management processes.
+Added: Their responsibilities include hiring appropriate personnel, approving budgets, integrating cybersecurity considerations into our risk management strategy, overseeing security-related reports, communicating key priorities, and helping prepare for cybersecurity incidents.
+Added: We conduct periodic training to keep personnel informed of cybersecurity threats and to communicate evolving information security policies, standards, processes, and practices.
+Added: Our cybersecurity incident response and vulnerability management processes are designed to escalate significant cybersecurity incidents to members of management, including to our President of P&T, CDO, the senior-most employee responsible for cybersecurity management, and the Cybersecurity Committee.
+Added: Our President of P&T, CDO, the senior-most employee responsible for cybersecurity management, and the Cybersecurity Committee work with our incident response team to mitigate and remediate potential issues.
+Added: These processes include reporting significant cybersecurity threats, risks, and mitigation activities to the Audit Committee and/or the Cybersecurity Committee, as appropriate.
+Added: The Audit Committee and the Cybersecurity Committee receive periodic reports, summaries, and presentations from management regarding our significant cybersecurity risks and threats, incidents, and response initiatives.
+Added: Through our cybersecurity governance practices, we strive to achieve a strong cybersecurity posture and to refine our security measures to respond to emerging threats.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.