14 unchanged sentences
We have established a Computer Security Incident Response Team (“CSIRT”) that identifies security incidents, characterizes the nature and severity of incidents, and provides diagnostic and corrective actions when appropriate.
+Added: The CSIRT is responsible for identifying, managing, and responding to security incidents against Qualys' infrastructure and corporate IT systems.
The security measures the CSIRT employs are consistent with relevant requirements of the National Institute of Standards and Technology (“NIST”), Federal Risk and Authorization Management Program (“FedRAMP”), International Organization for Standardization (“ISO”), and Federal Information Security Management Act (“FISMA”).
1 unchanged sentence
Our Incident Response Program and Plan describes the major phases of an incident management lifecycle which includes the preparation, detection and analysis, containment, eradication and recovery, and post-incident activity.
−Removed: Qualys' 24x7 Security Operations Center (“QSOC”) and CSIRT conduct Incident Response Plan testing and training on a periodic basis through tabletop exercises or simulated attack scenarios.
+Added: Qualys' 24x7 Cybersecurity Fusion Center and CSIRT conduct Incident Response Plan testing and training on a periodic basis through tabletop exercises or simulated attack scenarios.
This testing appraises our readiness to respond to such scenarios and tests the completeness and accuracy of the incident response plan.
−Removed: The QSOC and CSIRT teams drive these exercises to participants via various cyber security incident scenarios in the form of multiple injects.
+Added: The Cybersecurity Fusion Center and CSIRT teams drive these exercises to participants via various cyber security incident scenarios in the form of multiple injects.
Exercise participants primarily consist of members from various Qualys departments such as security operations, IT operations, network operations, and other departments depending on the selected scenario.
+Added: We have also established a Product Security Incident Response Team (“PSIRT”) that identifies, assesses, and responds to security incidents, risks, and vulnerabilities associated with Qualys’ commercial products.
+Added: The Qualys PSIRT investigates vulnerabilities and incidents across the entire Qualys product portfolio.
+Added: PSIRT coordinates product impact assessments and fixes based on industry standards such as the Common Vulnerabilities and Exposure (“CVE”) and Common Vulnerability Scoring System (“CVSS”).
+Added: PSIRT operates in alignment with relevant requirements and industry standards and coordinates its activities with the CSIRT.
We routinely evaluate the risks posed by third-party providers and engage with those whom fail to comply with our relevant contract requirements, or when we feel further action is needed to keep our risk levels within approved tolerance levels.
1 unchanged sentence
These service providers attest to our organization-wide design and implementation of cybersecurity policies and procedures, and annually monitor such policies and procedures from a safety perspective .
−Removed: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition, please refer to Item 1A, “Risk Factors,” in this annual report on Form 10-K, including the risk factor entitled “Our platform, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact our reputation and future sales.” We have not currently encountered any cybersecurity threats that have materially impaired our operations or financial standing.
+Added: For additional information regarding whether any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect our company, including our business strategy, results of operations, or financial condition , please refer to Item 1A, “Risk Factors,” in this annual report on Form 10-K, including the risk factor entitled “Our platform, products, website and internal systems may be subject to intentional disruption or other security incidents that could result in liability and adversely impact our reputation and future sales.” We have not currently encountered any cybersecurity threats that have materially impaired our operations or financial standing.
Our board of directors, with assistance from management, monitors and assesses strategic risk exposure, and our management team is responsible for the day-to-day management of the material risks we face.
6 unchanged sentences
Our CISO and our Security Steering Committee, along with other senior executives including the CEO and CTO, review and manage our cybersecurity policies and processes, including those described in “Risk Management and Strategy” above.
−Removed: The processes by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, include prompt communication from the CSIRT describing the severity and impact of the incident and status throughout the incident handling lifecycle and routine monitoring of key risk indicators.
+Added: The processes by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, include prompt communication from the CSIRT and PSIRT describing the severity and impact of the incident and status throughout the incident handling lifecycle and routine monitoring of key risk indicators.
Our CISO provides briefings to the Audit and Risk Committee along with our CEO and other members of our senior management team, both on a quarterly basis via the Qualys Security Steering Committee and as needed, regarding our cybersecurity risks and activities, including, if any, critical and high impact cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the emerging threat landscape.
1 unchanged sentence
In addition, our CISO and management team provide periodic briefings to the board of directors on cybersecurity risks and activities .
−Removed: Management is committed to notifying the Audit and Risk Committee, and the full Board in the event of a cyber incident that is confirmed to have a material effect on Qualys, or in the event that Qualys has identified a cyber risk that is likely to have a high probability of having a material impact on Qualys if not mitigated.
+Added: Management is required to notify the Audit and Risk Committee, and the full Board in the event of a cyber incident that is confirmed to have a material effect on Qualys, or in the event that Qualys has identified a cyber risk that is likely to have a high probability of having a material impact on Qualys if not mitigated .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.