3 unchanged sentences
We maintain an information security program designed to identify, assess, and manage material risks arising from cybersecurity threats to our critical networks, third-party hosted services, communications systems, hardware, software, and data, including intellectual property and confidential, proprietary, or sensitive information, such as customer data.
−Removed: Our President, Product and Technology (“President of P&T”), Chief Data Officer (“CDO”), the senior-most employee responsible for cybersecurity management, and other members of our cybersecurity and audit teams, help identify, assess, and manage cybersecurity threats and risks that may affect our business and operations.
+Added: Our President, Product and Technology (“President of P&T”), Chief Security Officer (“CSO”), the senior-most employee responsible for cybersecurity management, and other members of our cybersecurity and audit teams, help identify, assess, and manage cybersecurity threats and risks that may affect our business and operations.
To help us in assessing these threats, we use various methods, including, as applicable, using a combination of manual and automated tools, subscribing to threat reports and external intelligence feeds, conducting vulnerability assessments and penetration tests, collaborating with law enforcement, and operating a bug bounty program.
5 unchanged sentences
We mitigate the associated cybersecurity risks through a third-party risk management program, which may include vendor risk assessments, security questionnaires, reviews of vendor security programs, and contractual obligations for vendors to maintain specific security measures.
−Removed: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under the heading “Risk Factors” in Part I of this Annual Report on Form 10-K , including the risk factor titled “If our IT systems or data, or those of third parties with which we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.”
+Added: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under the heading “Risk Factors” in Part I of this Annual Report on Form 10-K , including the risk factor titled “If our IT systems or data, or those of third parties with which we work, are or were compromised, we could experience adverse consequences resulting from such compromise, including regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences, any of which could materially adversely affect our business, financial condition, results of operations, and prospects.”
Our Board oversees our enterprise risk management program, including cybersecurity risk.
−Removed: The audit committee of our Board (the “Audit Committee”) is responsible for oversight of our cybersecurity risk management processes, and a cross-functional cybersecurity committee (the “Cybersecurity Committee”), which is comprised of members of our management team, reports to the Audit Committee.
−Removed: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our President of P&T, CDO, and the senior-most
−Removed: employee responsible for cybersecurity management.
+Added: The audit committee of our Board (the “Audit Committee”) is responsible for oversight of our cybersecurity risk management processes.
+Added: A cross-functional cybersecurity steering committee (the “Cybersecurity Committee”), which is comprised of stakeholders across different functions, serves to enhance our cybersecurity governance and oversight.
+Added: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management team, including our President of P&T, CSO, and the senior-most employee responsible for cybersecurity management.
Our President of P&T has over 25 years of experience in senior executive roles that involved ownership of, and accountability for, cybersecurity matters, including Chief Information Officer, Chief Technology Officer, and Senior Vice President / General Manager.
−Removed: Our CDO has over 15 years of experience in IT and previously served as the Chief Information and Digital Experience Officer for a home automation company.
−Removed: Prior to that, she held various leadership roles at a computer software company.
−Removed: Members of our management team, including our President of P&T, CDO, and the senior-most employee responsible for cybersecurity management, lead our cybersecurity assessment and management processes.
+Added: Our CSO has over 25 years of information security leadership experience, including as Chief Information Security Officer at a global event technology and ticketing platform and at an enterprise identity governance company.
+Added: He has also held security leadership roles across software, e-commerce, SaaS, and technology companies of varying scale and maturity.
+Added: Members of our management team, including our President of P&T, CSO, and the senior-most employee responsible for cybersecurity management, lead our cybersecurity assessment and management processes.
Their responsibilities include hiring appropriate personnel, approving budgets, integrating cybersecurity considerations into our risk management strategy, overseeing security-related reports, communicating key priorities, and helping prepare for cybersecurity incidents.
We conduct periodic training to keep personnel informed of cybersecurity threats and to communicate evolving information security policies, standards, processes, and practices.
−Removed: Our cybersecurity incident response and vulnerability management processes are designed to escalate significant cybersecurity incidents to members of management, including to our President of P&T, CDO, the senior-most employee responsible for cybersecurity management, and the Cybersecurity Committee.
−Removed: Our President of P&T, CDO, the senior-most employee responsible for cybersecurity management, and the Cybersecurity Committee work with our incident response team to mitigate and remediate potential issues.
+Added: Our cybersecurity incident response and vulnerability management processes are designed to escalate significant cybersecurity incidents to members of management, including to our President of P&T, CSO, the senior-most employee responsible for cybersecurity management, and the Cybersecurity Committee.
+Added: Our President of P&T, CSO, the senior-most employee responsible for cybersecurity management, and the Cybersecurity Committee work with our incident response team to mitigate and remediate potential issues.
These processes include reporting significant cybersecurity threats, risks, and mitigation activities to the Audit Committee and/or the Cybersecurity Committee, as appropriate.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.