15 unchanged sentences
The CSIRT is responsible for identifying, managing, and responding to security incidents against Qualys' infrastructure and corporate IT systems.
−Removed: The security measures the CSIRT employs are consistent with relevant requirements of the National Institute of Standards and Technology (“NIST”), Federal Risk and Authorization Management Program (“FedRAMP”), International Organization for Standardization (“ISO”), and Federal Information Security Management Act (“FISMA”).
+Added: The security measures the CSIRT employs are consistent with relevant requirements of the National Institute of Standards and Technology (“NIST”), Federal Risk and Authorization Management Program (“FedRAMP”), International Organization for Standardization
+Added: (“ISO”), and Federal Information Security Management Act (“FISMA”).
We have also adopted certain guidelines from NIST and the United States Computer Emergency Readiness Team.
8 unchanged sentences
PSIRT operates in alignment with relevant requirements and industry standards and coordinates its activities with the CSIRT.
−Removed: We routinely evaluate the risks posed by third-party providers and engage with those whom fail to comply with our relevant contract requirements, or when we feel further action is needed to keep our risk levels within approved tolerance levels.
+Added: We routinely evaluate the risks posed by third-party providers and engage with those who fail to comply with our relevant contract requirements, or when we feel further action is needed to keep our risk levels within approved tolerance levels.
We engage assessors, consultants, auditors, and other third parties in order to obtain external validation for effectiveness and adequacy of our security posture in compliance with regulatory requirements.
6 unchanged sentences
state government.
−Removed: He holds several industry certifications including CISSP, OSCP, CCSP, and GCFA and is also a graduate of the Carnegie Mellon University’s Chief Information Security Officer Executive Program.
+Added: He holds a degree in computer science and has held industry certifications including CISSP, OSCP, CCSP, and GCFA and is also a graduate of the Carnegie Mellon University’s Chief Information Security Officer Executive Program.
Our CEO is also a cybersecurity industry expert who has deep insight and over two decades of experience in cybersecurity, technology and information security.
1 unchanged sentence
The processes by which our CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents, include prompt communication from the CSIRT and PSIRT describing the severity and impact of the incident and status throughout the incident handling lifecycle and routine monitoring of key risk indicators.
−Removed: Our CISO provides briefings to the Audit and Risk Committee along with our CEO and other members of our senior management team, both on a quarterly basis via the Qualys Security Steering Committee and as needed, regarding our cybersecurity risks and activities, including, if any, critical and high impact cybersecurity incidents and related responses, cybersecurity systems testing, activities of third parties, and the emerging threat landscape.
+Added: Our CISO provides briefings to the Audit and Risk Committee along with our CEO and other members of our senior management team, both on a quarterly basis via the Qualys Security Steering Committee and as needed, regarding our cybersecurity risks and activities, including, if any, critical and high impact cybersecurity incidents and related responses,
+Added: cybersecurity systems testing, activities of third parties, and the emerging threat landscape.
Our Audit and Risk Committee provides regular updates to the board of directors on such reports.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.