5 unchanged sentences
Our cybersecurity risk management program is designed based on industry standards and informed by the National Institute of Standards and Technology Cybersecurity Framework.
−Removed: We perform risk assessments in which we map and prioritize identified cybersecurity risks, including risks associated with our use of third- and fourth-party vendors, Medical Groups, Privia Providers and Affiliated Practices, based on probability, immediacy and potential magnitude.
+Added: We perform risk assessments in which we map and prioritize identified cybersecurity risks, including risks associated with our use of third- and fourth-party vendors, Medical Groups, Privia Providers and their Affiliated Practices, based on probability, immediacy and potential magnitude.
These assessments inform our cybersecurity risk management strategies and oversight processes, and we view cybersecurity risks as one of the key risk categories we face .
4 unchanged sentences
and perform simulated breach testing and tabletop exercises to simulate responses to information security incidents.
−Removed: We have established processes to oversee and manage risks associated with our third- and certain fourth-party service providers, including regular security assessments and compliance reviews.
+Added: We have established processes to oversee and manage risks associated with our third- and certain fourth-party vendors, including regular security assessments and compliance reviews.
We use the findings from these and other processes to assess our information and cybersecurity practices, procedures and technologies, including for potential enhancements to our risk mitigation strategies.
21 unchanged sentences
The CSIRT is comprised of the CISO and other key members of management, including the Privacy Officer, Chief Technology Officer, Chief Audit and Compliance Officer, General Counsel and other members of management and our technical response teams as necessary to appropriately respond to an incident, including mitigation, remediation and any required or recommended disclosure of an incident.
−Removed: Furthermore, as part of management’s oversight of information and cybersecurity risks, we maintain a Third Party Access Committee, comprised of our CISO, Privacy Officer, and colleagues drawn from across the organization, including our technology, compliance and legal teams, which is responsible for reviewing and monitoring compliance for third- and certain fourth-party requests for and access to certain Company data and information.
−Removed: Our headquarters are located in Arlington, Virginia.
−Removed: Our lease on this space expires on September 30, 2026.
+Added: Furthermore, as part of management’s oversight of information and cybersecurity risks, we maintain a Third Party Access Committee, comprised of our CISO, Privacy Officer, Chief Technology Officer and colleagues drawn from across the organization, including our technology, compliance and legal teams, which is responsible for reviewing and monitoring compliance for third- and certain fourth-party requests for and access to certain Company data and information.
+Added: Our headquarters is located in Arlington, Virginia.
+Added: Our lease on this space expires on December 31, 2031.
We have also leased space for our other offices throughout the United States.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.