9 unchanged sentences
As part of this process, and our processes aimed at providing for the availability of critical data and systems, maintaining regulatory compliance, identifying and managing our risks from cybersecurity threats, and protecting against, detecting, and responding to cybersecurity incidents, as such term is defined in Item 106 (a) of Regulation S-K, we undertake the below listed activities, among others:
−Removed: ● maintain a risk register and risk assessment process based on The National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (however, this does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST Cybersecurity Framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business);
+Added: maintain a risk register and risk assessment process for our Information Security and Management System (“ISMS”) based on the ISO 27001:2022 clauses and controls;
use various third -party software testing products and services designed to test and assess the security of our software;
5 unchanged sentences
conduct regular phishing email simulations for employees and contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats;
+Added: conduct periodic user account reviews to confirm authorized access to business-critical systems;
use findings and root cause analysis of cybersecurity incidents to improve our cybersecurity processes and technologies;
2 unchanged sentences
maintain an employee handbook, Code of Conduct, and Acceptable Use policy that makes clear the importance of cybersecurity and protection of PDF and customer intellectual property;
−Removed: ● our incident response policy and plan specify the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal and reporting obligations and mitigate brand and reputational damage.
+Added: our cybersecurity incident response policy and plan specify the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal and reporting obligations and mitigate brand and reputational damage.
We regularly exercise and update the plan after actual incident responses or simulated incident response scenarios.
−Removed: We subscribe to several external independent monitoring services to score and assess our externally facing network and information services and we engage a third-party security firm at least annually to conduct external and web penetration testing exercises on our corporate network and our commercial SaaS service platform.
+Added: We subscribe to several external independent monitoring services to score and assess our externally facing network and information services and we engage a third -party security firm at least annually to conduct external and web penetration testing exercises on our corporate network and our commercial SaaS service platform and other commercial products and services in scope of our ISMS.
Our processes also address cybersecurity threat risks associated with our use of third -party service providers, including those in our supply chain or who have access to our customer and employee data or to our systems.
7 unchanged sentences
if we or our third -party providers fail to protect confidential information and/or experience a cyber incident, there may be damage to our brand and reputation, material financial penalties, and legal liability.” and “Our business is subject to evolving corporate governance and public disclosure regulations and expectations, including with respect to environmental, social and governance matters that could expose us to numerous risks.” included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10 -K.
−Removed: For more than 5 years, we have not identified any known cybersecurity threats including as a result of any prior cybersecurity incidents, that have materially impacted us, including the expenses we have incurred from cybersecurity incidents that were immaterial.
+Added: For more than 6 years, we have not identified any known cybersecurity threats including as a result of any prior cybersecurity incidents, that have materially impacted us or our operations, business strategy results of operations, or financial condition, including the expenses we have incurred from cybersecurity incidents that were immaterial.
This includes penalties and settlements, of which there were none.
−Removed: We face risks from
−Removed: cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
+Added: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
Cybersecurity Governance
8 unchanged sentences
The Audit Committee, which comprises at least two individuals with experience in cybersecurity and related matters, meets with these members of senior management to review our information technology and data security policies and practices, and to assess current and projected threats, cybersecurity incidents, and related risks.
−Removed: Our Vice President of Operations reports directly to our executive management team and advises the company on cybersecurity risks and assesses the effectiveness of information technology and information security processes and business policies impacting our overall cybersecurity risk.
−Removed: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Vice President of Operations and a cross section of subject matter experts from Information Technology, Exensio Cloud Operations and Corporate Legal and team.
−Removed: Such individuals have collectively over 30 years of prior work experience in various roles involving managing information security, data privacy risks and regulatory frameworks, developing cybersecurity strategy, implementing effective information and cybersecurity programs and experience in security controls testing and the planning and executing of independent cybersecurity assessments.
+Added: Our Vice President of Operations reports directly to our executive management team and advises us on cybersecurity risks and assesses the effectiveness of information technology and information security processes and business policies impacting our overall cybersecurity risk.
+Added: The VP of Operations serves as the senior executive responsible for owning and operating our ISMS.
+Added: Reporting directly to this role are the Director of Corporate IT and the Director of Network Security, who—under the VP’s leadership—jointly oversee all aspects of security policy management, cybersecurity risk management, vulnerability management, identity and access management, incident response, security training, and disaster recovery across the organization.
+Added: The VP of Operations leads our annual information security governance, risk, and compliance assessment in collaboration with the General Counsel, the Chief People Officer, the Chief Financial Officer, and product leadership.
+Added: Together, they evaluate and refine our risk management strategy and ensure ongoing compliance with the ISMS.
+Added: The VP of Operations has over five years of direct experience in this role and more than 25 years of tenure with us, including building and leading engineering and IT organizations.
+Added: This institutional and operational expertise enables the VP to guide our security posture, technology adoption strategy, and enterprise-wide risk management efforts.
Our Incident Response Policy is reviewed annually and documents the controls and procedures for timely and accurate reporting of material cybersecurity incidents to the relevant parties, including the Audit Committee when applicable.
Our Incident Response Team leads the response to any reported cybersecurity event and comprises experts from Engineering, Information Technology, Legal, Cloud Operations, and Network Security.
−Removed: The Vice President of Operations and Executive Vice President of Products and Solutions are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above including the incident response.
+Added: The Vice President of Operations and Executive Vice President of Products and Solutions take steps to stay informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above including the incident response.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.