2 unchanged sentences
Risk Management and Strategy
−Removed: Our cybersecurity program, which is primarily documented in our business interruption and incident response policy, is designed to assess, identify and manage material risks from cybersecurity threats, and is a component of our overall enterprise risk program.
+Added: Our cybersecurity program, which is primarily documented in our business interruption and incident response policy, is designed to assess, identify and manage material risks from cybersecurity threats.
+Added: Our program leverages components from the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), which we use to help us identify, assess and manage cybersecurity risks relevant to our business.
+Added: O ur cybersecurity program is a component of our overall enterprise risk program.
We deploy multiple strategies and dedicate significant resources toward systems designed to identify, assess, manage, mitigate and respond to cybersecurity threats.
3 unchanged sentences
These policies and procedures also focus on identifying vulnerabilities in our internal and external environments and remediating those vulnerabilities.
−Removed: To combat cybersecurity risk, we focus on proactive procedures such as patch management and quarterly cybersecurity training of our employees.
−Removed: In an effort to mitigate cyber risks for customer-facing software, we incorporate the protocols described above along with software specific programs such as a bug bounty system and partnerships with external experts.
+Added: To combat cybersecurity risk, we focus on proactive procedures such as patch management and emphasize the importance of cybersecurity across our organization through quarterly trainings, which include best practices and participation in simulated phishing exercises to strengthen employee vigilance.
We evaluate our controls and response protocols at least twice a year using external third-party assessors and consultants in both advisory and adversarial engagements.
These third-party experts are familiar with our systems and could be retained in the event of a significant incident to assist us in evaluating and responding to such an incident.
+Added: We also regularly test our environment as part of our focus on identifying and eliminating vulnerabilities.
We incorporate the lessons learned from these engagements into our cybersecurity program.
−Removed: Our cybersecurity program also includes controls to manage risks associated with our use of third-party service providers;
+Added: Recognizing the risks posed by external partners, we have implemented a third-party risk management program, which includes due diligence assessments, contractual safeguards, and regular monitoring of vendors and partners with access to our systems or data;
however, we cannot ensure in all circumstances that their defensive efforts will be successful.
19 unchanged sentences
Our incident response policy outlines our protocols for assessing, managing and responding to cyber incidents.
−Removed: This policy guides the response of our global IT team, which, depending on the significance of the incident, includes activating response plans from third-party partners, escalating the issue to executive management, notifying one or more members of our Board, maintaining communication with users and notifying law enforcement and other agencies if warranted.
+Added: This policy guides the response of our global IT team, which, depending on the significance of the incident, may include escalating the issue to executive management, notifying one or more members of our Board, maintaining communication with users and notifying law enforcement and other agencies if warranted.
We may also receive assistance from a third-party security operations center (SOC) and other industry-leading third-party providers.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.