12 unchanged sentences
We routinely review and assess our business groups and systems to identify and prioritize areas of risk, including cybersecurity risk.
−Removed: The results of these assessments and progress against prioritized goals are presented to the board of directors each quarter.
+Added: The results of these assessments and progress against prioritized goals are presented to a committee of our board of directors each quarter.
We have incurred and may in the future incur significant costs in order to implement, maintain, and/or update security systems we believe are necessary to protect our IT infrastructure.
12 unchanged sentences
Unauthorized network intrusions or other significant information security incidents against third-party systems used by the Company internally are handled in the same manner as internal systems.
−Removed: However as described in Part 1.
+Added: However as described in Part I.
Risk Factors of this Annual Report on Form 10-K under “Risks Related to the Operation and Growth of Our Business”, we have limited insight into the data privacy or security of third-party service providers and our response may be limited or more difficult because we may not have direct access to their systems.
−Removed: Although we believe we have adequate resources and sufficient policies, procedures, and oversight in place to identify and manage IT security risks related to our business operations, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective.
−Removed: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1.
+Added: Although we believe we have adequate resources and sufficient policies, procedures, and oversight in place to identify and manage IT security risks related to our business operations, there can be no guarantee that our policies and
+Added: procedures will be properly followed in every instance or that those policies and procedures will be effective.
+Added: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part I.
Risk Factors in this Annual Report on Form 10-K under “Risks Related to the Operation and Growth of Our Business.”
16 unchanged sentences
Our full board of directors oversees our risk management including but not limited to IT and cybersecurity policies, procedures, and risk assessments.
−Removed: Our management reports to our board of directors on information security matters on a quarterly basis, or more frequently as needed.
One of the key functions of our board of directors is informed oversight of our various processes for managing risk.
1 unchanged sentence
This includes a discussion of the likelihood and potential magnitude of various risks, including cybersecurity risks, and any actions management has taken to limit, monitor or control those risks.
−Removed: At each quarterly board meeting, the full board receives the quarterly cybersecurity board update that is prepared by our CISO.
+Added: In October 2025, the board established a Cybersecurity Committee and adopted a Charter of the Cybersecurity Committee.
+Added: Pursuant to that charter the primary purpose of the Committee is to assist the Board in fulfilling its oversight responsibilities with respect to the Company’s information technology use and data security, including, but not limited to, enterprise cybersecurity, privacy, data collection and protection and compliance with information security and data protection laws.
+Added: Our management reports to the Cybersecurity Committee on information security matters on a quarterly basis, or more frequently as needed.
+Added: The Cybersecurity Committee reports updates to the board of directors as applicable.
+Added: At each quarterly Cybersecurity Committee meeting, the committee members receive the quarterly cybersecurity board update that is prepared by our CISO .
The report provides a comprehensive cybersecurity update for the past quarter, usually including topics such as details on threat landscape, incident response, security metrics and performance, compliance and regulatory updates, cybersecurity investments and budget, employee security awareness and trainings, vendor risk management updates, business continuity and disaster recovery updates, and an update on cybersecurity strategy, projects and roadmap.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.