6 unchanged sentences
We maintain a suite of information security, privacy, and data protection related policies, standards, and procedures leveraging the National Institute of Standards and Technology (“NIST”) along with the COBIT 2019 framework to align with applicable laws, regulatory guidance, and industry best practices.
−Removed: We employ a security operations team led by our Chief Information and Security Officer, who has over 20 years experience in information systems and security.
−Removed: Our security operations team is primarily responsible for the day-to-day assessment and management for material risks from cybersecurity threats.
+Added: We employ an experienced security operations team that is responsible for the day-to-day assessment and management for material risks from cybersecurity threats.
We require mandatory cybersecurity, privacy, and information handling training for all team members upon onboarding and on an annual basis thereafter.
21 unchanged sentences
The ERM Committee is comprised of select board members and select members of executive management and meets at least quarterly.
−Removed: During ERM meetings, our Chief Information and Security officer discusses key areas of cyber risk, and reviews key cybersecurity metrics and results of cybersecurity risk assessments and testing.
+Added: During ERM meetings, our Chief Technology Officer and Head of Technology Engineering discuss key areas of cyber risk, and reviews key cybersecurity metrics and results of cybersecurity risk assessments and testing.
In the event of a cybersecurity incident, our ERM Committee would also receive reports from our incident response team.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.