1 unchanged sentence
Cybersecurity
−Removed: We manage cyber risk on a daily basis, as we face a multitude of threats ranging from ransomware and phishing attacks, business email compromise, and a wide array of other cyber-criminal tactics aimed at impacting our operations and compromising our sensitive information.
+Added: We manage cyber risk on a daily basis, as we face a multitude of threats ranging from ransomware, phishing attacks, business email compromise, and a wide array of other cyber-criminal tactics aimed at impacting our operations and compromising our sensitive information.
Our customers, suppliers, subcontractors, and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations.
−Removed: Accordingly, we have invested in resources (people, process, and technology) aimed at identifying, assessing, and responding to cyber threats.
+Added: Accordingly, we have invested in resources (people, processes, and technology) aimed at identifying, assessing, and responding to cyber threats.
Our Board of Directors (“Board”) oversees management’s processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure to our strategic objectives.
−Removed: While the Board reviews the Company’s cybersecurity program annually, the Nominating, Governance, and Risk Committee of the Board has primary responsibility for cybersecurity as part of its risk oversight mandate.
−Removed: The Nominating, Governance, and Risk Committee is scheduled to have regular updates on cybersecurity matters from our Chief Information Security Officer (“CISO”) and members of the CISO’s team at least two times per year.
−Removed: The CISO will discuss management’s actions to identify and detect threats and review the structure of and enhancements to the Company’s defenses as well as management’s progress on its cybersecurity strategic roadmap.
−Removed: The Nominating, Governance, and Risk Committee Chair reports back to the full Board after each Committee meeting, including information relating to the cybersecurity discussions.
−Removed: Our Cybersecurity organization, which includes corporate and product security, is led by our CISO.
−Removed: Our CISO, reporting directly to our Chief Technology Officer (“CTO”), is responsible for developing and implementing our cybersecurity program, including setting the directional security strategy and continuous improvement plans for the overall security program.
−Removed: Our CISO has over a decade of experience as a leader of cyber-security and technology risk management programs in both healthcare and medical device manufacturing organizations.
−Removed: This experience is coupled with obtaining and maintaining multiple industry certifications, including Certified Information Systems Security Professional certifications (CISSP), and Certified Information Security Manager (CISM).
−Removed: The CTO ensures cyber-security measures are prioritized across research and development, software engineering, and our IT functions.
−Removed: Assessing, identifying and managing cybersecurity-related risks are also integrated into our overall enterprise risk management (“ERM”) process.
−Removed: Cybersecurity-related risks are included in the risk universe that the ERM function evaluates to assess top risks to the enterprise on an annual basis.
−Removed: To the extent the ERM process identifies a heightened cybersecurity-related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.
−Removed: The ERM annual risk assessment is presented to the Board, with additional reporting during the year to the Nominating, Governance and Risk Committee.
+Added: While the Board reviews the Company’s cybersecurity program annually, the Nominating, Governance, and Risk Committee (“NGR Committee”) of the Board has primary responsibility for cybersecurity as part of its risk oversight mandate.
+Added: The NGR Committee is updated on cybersecurity matters from our Chief Information Security Officer (“CISO”) and members of the CISO’s team at least twice annually.
+Added: The CISO discusses management’s actions to identify and detect threats and reviews the structure of and enhancements to the Company’s defenses as well as management’s progress on its cybersecurity strategic roadmap.
+Added: The NGR Committee Chair reports to the full Board after each Committee meeting, including information relating to the cybersecurity discussions.
+Added: Our Cybersecurity organization, which includes infrastructure security, product security, technology risk management, and security awareness and culture is led by our CISO.
+Added: Our CISO, reports directly to our Chief Technology Officer (“CTO”) and is responsible for developing and implementing our cybersecurity program, including setting the directional security strategy and continuous improvement plans for the overall security program.
+Added: Our CISO has over a decade of experience leading cyber-security and technology risk management programs in both healthcare and medical device manufacturing organizations and maintains multiple industry certifications, including Certified Information Systems Security Professional and Certified Information Security Manager.
+Added: The CTO ensures cyber-security measures are prioritized across research and development, software engineering, and our information technology functions.
+Added: The CTO supports the CISO in chairing a quarterly Technology Risk Committee aimed at providing proper oversight and governance of the cybersecurity program, remediation of identified technology risks, and execution of the cybersecurity strategy.
+Added: Our processes for assessing, identifying, and managing cybersecurity-related risks is also included within our overall enterprise risk management (ERM) program.
We leverage the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework to better manage and respond to cybersecurity risks in protecting our infrastructure and sensitive data.
−Removed: We have mapped our people, process, and technology in alignment with the categories defined in the NIST industry standard framework:
+Added: We have mapped and base-lined our people, processes, and technology in alignment with the categories defined in the NIST industry standard framework:
Identify, Protect, Detect, Respond, and Recover.
Additionally, Insulet’s information security management system is ISO 27001 and 27701 certified.
−Removed: For the sixth consecutive year, Insulet received re-certification from the ISO, which is the recognized standard for information security management and privacy best practices that adheres to the highest international data security standards.
+Added: For the seventh consecutive year, Insulet received re-certification from the ISO, which is the recognized standard for information security management and privacy best practices that adheres to the highest international data security standards.
+Added: In 2024, we also added ISO certifications specific to Cloud Computing and Health Informatics, which pairs with and supports other applicable medical device and international certification requirements.
We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection, and mitigation .
16 unchanged sentences
As a manufacturer of medical devices, OT is a vital component of our business operations.
−Removed: Interconnectedness between OT technology and other business critical IT infrastructure can create a material cyber risk.
−Removed: Insult deploys segmentation and OT-specific monitoring capabilities to mitigate and monitor this risk as our OT environment continues to expand to meet the needs of our business.
+Added: Interconnectedness between OT technology and other business critical information technology
+Added: infrastructure can create a material cyber risk.
+Added: Insult deploys segmentation and OT-specific monitoring capabilities to mitigate and monitor this risk.
• Vendor Management.
3 unchanged sentences
We have an operational information security training program for all employees.
−Removed: In addition to annual trainings, we have frequent “nanolearning” targeted trainings.
−Removed: These quick trainings encourage participation, provide constant reminders to our employees to be vigilant and give them the tools to recognize and protect against cyber threats.
+Added: In addition to annual trainings, we require and monitor completion of frequent “nanolearning” targeted trainings.
+Added: These quick trainings provide constant reminders to our employees to be vigilant and give them the tools to recognize and protect against cyber threats.
We also conduct phishing simulations to test effectiveness of our training program with the aim of reducing the percentage of employees who click on suspicious emails.
We are intensely focused on protecting the security of our products;
−Removed: our guiding principle of “secure by design” underlies all of our product development.
−Removed: We have a cybersecurity team embedded with our research and development group to deliver on this mission as well as a Product Cybersecurity Risk Management Policy which is aligned with FDA guidance.
−Removed: Omnipod DASH was the first FDA-cleared insulin pump certified under the Diabetes Technology Society’s “Standard for Wireless Diabetes Device Security” cybersecurity assurance standard and program, known as DTSec.
−Removed: This certification is a cybersecurity standard intended to raise confidence in the security of network connected medical devices through independent expert evaluation.
−Removed: Omnipod 5 incorporates cybersecurity by design principles, which includes secure data transfer between the Pod, Controller, cloud storage, and compatible continuous glucose monitors.
+Added: our guiding principle of “security and privacy by design” underlies all of our product development.
+Added: We have a cybersecurity team embedded with our research and development group to deliver on this mission as well as a Product Cybersecurity Risk Management Policy that aligns with FDA guidance.
+Added: Omnipod 5 incorporates cybersecurity by design principles, which includes secure data transfer between the Pod, Controller, cloud storage, and compatible CGMs.
Our Secure Software Development Lifecycle enforces application testing and continuous monitoring to identify security risks.
−Removed: Omnipod 5 is certified by ISO 27001 and the U.K.
+Added: Omnipod 5 is certified by ISO (27001, 27017 and 27799) and the U.K.
Cyber Essentials.
1 unchanged sentence
Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.
−Removed: Should a cyber incident occur, we have in place the Insulet Cybersecurity Incident Response Procedure (“CIRP”), which is designed to enable us to respond efficiently to any incidents.
+Added: Should a cyber incident occur, we have in place the Insulet Cybersecurity Incident Response Procedure (“CIRP”) and Crisis Management Plan, which are designed to enable us to respond efficiently to any incidents.
Pursuant to the CIRP, cybersecurity incidents are reviewed and rated by our CISO and his team.
A cybersecurity incident rated at predefined risk levels will be escalated to CTO, the Chief Compliance Officer, and the General Counsel and assessed for materiality and disclosure to the CEO and the Board.
−Removed: Our internal Disclosure Committee would review any planned public disclosures or filings.
+Added: Our internal Disclosure Committee will review any planned public disclosures or filings.
CIRP provides the organizational and operational structure to respond to incidents that may affect the confidentiality, integrity or availability of our information systems.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.