8 unchanged sentences
Our cybersecurity risk management program is integrated into our overall enterprise risk management program , and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.
−Removed: Our cybersecurity risk management program includes:
−Removed: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise-IT environment;
+Added: Key elements of our cybersecurity risk management program include but are not limited to:
+Added: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information;
• adoption of various cybersecurity software, including but not limited to cloud-based malware, ransomware and antivirus software, phishing monitoring and artificial intelligence-based anomaly detection;
• a security team principally responsible for managing (1) our cybersecurity risk-assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;
−Removed: • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;
+Added: • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes ;
• cybersecurity awareness training of our employees, incident response personnel and senior management;
3 unchanged sentences
For more information, see the section titled “Risk Factor—Risks Related to Data Privacy and Cybersecurity—Cyberattacks or other failures in our telecommunications or information technology, or IT, systems, or those of our collaborators, contract research organizations, third-party logistics providers, distributors or other contractors or consultants, could result in information theft, data corruption and significant disruption of our business operations.”
−Removed: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other IT risks as well as management’s implementation of our cybersecurity risk management program.
−Removed: The Audit Committee receives periodic reports from management on our cybersecurity risks.
−Removed: In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.
+Added: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and risks, including oversight of management’s implementation of our cybersecurity risk management program.
+Added: T he Audit Committee receives periodic reports from management on our cybersecurity risks.
+Added: In addition, management updates the Audit Committee, when it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant.
The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.
−Removed: We have an internal cybersecurity team, led by our Chief Financial Officer, who is responsible for (i) managing our overall cybersecurity risk-management program;
−Removed: (ii) assessing and managing our risks from cybersecurity
+Added: We have an internal cybersecurity team, reporting to our Chief Financial Officer , who is responsible for (i) managing our overall cybersecurity risk-management program;
+Added: (ii) assessing and managing our risks from cybersecurity threats;
and (iii) overseeing retained cybersecurity consultants and providers for additional external expertise.
−Removed: This internal team's experience includes over 30 years in cybersecurity implementation, testing and management.
−Removed: We have an Executive Compliance Committee consisting of executive officers and members from senior management across the regulatory, quality, legal, finance and people operations functions that supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which includes updates from our internal cybersecurity team, as relevant;
+Added: This internal team is led by our Vice President of Information Technology, who has over 20 years of experience managing cybersecurity, systems architecture and complex data operations for biotechnology and pharmaceutical companies.
+Added: Additional team members have between 12 to 15 years of experience each in cybersecurity, IT management and cloud architecture.
+Added: The internal team works closely with external network operations and cybersecurity teams who provide 24/7 network operations and cybersecurity review and response capabilities.
+Added: We have an Executive Compliance Committee consisting of executive officers and members from senior management across the regulatory, quality, legal, finance and people operations functions that takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which includes updates from our internal cybersecurity team, as relevant;
review of any threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us;
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.