6 unchanged sentences
Under this framework, our information security function, led by our Chief Information Officer, helps to identify, assess and manage the Company’s cybersecurity threats and risks.
−Removed: This function helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example deploying automated tools in certain environments, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain aspects of the Company’s threat environment, evaluating certain threats that are reported to us, conducting internal and external audits and internal threat assessment of certain environments, engaging third parties to conduct threat assessments, and conducting vulnerability assessments.
−Removed: We have engaged third-party providers to periodically assess certain of our internal controls and procedures for information security.
−Removed: We have also taken certain measures to mitigate cybersecurity risks, including, for example, cybersecurity awareness training for employees and management, periodic testing through simulated “phishing” campaigns (and require remedial training based on results) and the adoption of an incident response plan, vulnerability management policy and business recovery plan.
−Removed: Furthermore, our information security function works with a security committee (the “Security Committee") to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business and evaluate material risks from cybersecurity threats against our overall business objectives.
−Removed: We use third-party service providers to perform a variety of functions throughout our business, such as CROs and contract manufacturing organizations ("CMOs").
−Removed: Under our information security function, we perform risk and security assessments for certain of our vendors that involves a review of the vendor’s written security program.
−Removed: Depending on the nature of the services provided, and the sensitivity of the Information Systems and Data at issue, and the identity or experience of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the vendor.
+Added: Key elements of our cybersecurity risk management program include but are not limited to the following efforts.
+Added: We conduct assessments to help identify and assess material risks from cybersecurity threats to our critical systems and information.
+Added: We monitor and evaluate our threat environment using various methods including, for example deploying automated tools in certain environments, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain aspects of our threat environment, evaluating certain threats that are reported to us, conducting internal and external audits and internal threat assessment of certain environments, engaging third parties to conduct threat assessments, and conducting vulnerability assessments.
+Added: We also engage third-party providers, where appropriate, to periodically assess certain of our internal controls and processes for information security.
+Added: Further, we take certain measures to mitigate cybersecurity risks, including, for example, cybersecurity awareness training for employees and management, periodic testing through simulated "phishing" campaigns (and require remedial training based on results) and the adoption of an incident response plan that includes procedures for responding to cybersecurity incidents, a vulnerability management policy and a business recovery plan.
+Added: Furthermore, our information security team works with a security committee (the "Security Committee") to manage our cybersecurity risk management processes, our security controls, and our response to cybersecurity incidents.
+Added: We use third-party service providers to perform a variety of functions throughout our business, such as CROs and CMOs.
+Added: Under our information security function, we perform risk and security assessments for certain key vendors that involves a review of the vendor’s written security program.
+Added: Depending on the nature of the services provided, the vendor's criticality to our operations and the vendor's respective risk profile, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the vendor.
We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.
We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
−Removed: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see “Risk Factors - Our internal information technology systems, and those of our third-party CROs and other third parties upon which we rely, are subject to failure, security breaches and other disruptions, which could result in a material disruption of our investigational products’ development programs, jeopardize sensitive information, prevent us from accessing critical information or result
−Removed: in a loss of our assets, and potentially expose us to notification obligations, loss, liability or reputational damage and otherwise adversely affect our business.” in Part I, Item 1A herein.
−Removed: Our board of directors considers cybersecurity risk management as part of its general oversight function.
−Removed: The board of directors’ audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.
−Removed: Our Security Committee is comprised of key management stakeholders and experts and is chaired by our Chief Information Officer , who has over 20 years of strategic and operational IT/cybersecurity leadership experience and multiple cybersecurity certifications, from leading security organizations such as (ISC)2, Cloud Security Alliance, Cisco Security, Microsoft Security.
−Removed: The Security Committee is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.
−Removed: The audit committee receives periodic reports from our Chief Information Officer concerning significant cybersecurity threats and risk and the processes we have implemented to address them.
−Removed: Under our incident response plan, certain incidents would also be reported to the board.
+Added: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors - Our internal information technology systems, and those of our third-party CROs and other third parties upon which we rely, are subject to failure, security breaches and other disruptions, which could result in a material disruption of our investigational products’ development programs, jeopardize sensitive information, prevent us from accessing critical information or result in a loss of our assets, and potentially expose us to notification obligations, loss, liability or reputational damage and otherwise adversely affect our business." in Part I, Item 1A herein.
+Added: Our board of directors considers cybersecurity risk management as part of its general oversight function and has delegated to the Audit Committee oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management programs.
+Added: The Audit Committee receives periodic reports from management, specifically our Chief Information Officer (“CIO”) , on our information security program and cybersecurity risks.
+Added: In addition, management updates the Audit Committee, where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.
+Added: Our CIO chairs our Security Committee, which helps to identify, assess and manage our material cybersecurity threats and risks.
+Added: Our CIO has over 20 years of strategic and operational IT/cybersecurity leadership experience and multiple cybersecurity certifications, from leading security organizations, such as (ISC)2, Cloud Security Alliance, Cisco Security, Microsoft Security.
Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include:
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.