13 unchanged sentences
In addition, we employ a range of tools and services to inform our assessment, identification and management of material risks from cybersecurity threats, which include from time to time:
−Removed: • monitoring emerging data protection laws, including the California Consumer Privacy Act and the General Data Protection Regulation, and implementing responsive changes to our processes;
+Added: • monitoring emerging data protection laws and implementing responsive changes to our processes;
• undertaking periodic reviews of our policies and statements related to cybersecurity;
4 unchanged sentences
Incident Response Team and Outside Resources :
−Removed: We have formed an Incident Response Team that monitors and mitigates material risks from cybersecurity threats.
+Added: We have an Incident Response Team that monitors and mitigates material risks from cybersecurity threats.
This team is composed of members from the information security, engineering and legal teams.
The Incident Response Team and our internal legal team work in tandem to estimate the severity and materiality of a cybersecurity incident, create a response plan and inform other stakeholders as appropriate, including the Audit Committee or the full Board.
−Removed: In addition, we engage several third party service providers to monitor cybersecurity threats in the market more broadly, including in relation to phishing, data leaks on the dark web, firewalls, code security and endpoint protection.
+Added: In addition, we engage several third-party service providers to monitor cybersecurity threats in the market more broadly, including in relation to phishing, artificial intelligence and machine learning, data leaks on the dark web, firewalls, code security and endpoint protection.
To identify risks from cybersecurity threats associated with these third-party service providers, we conduct pre-contract screening and due diligence and post-contract monitoring.
Cybersecurity Task Force :
−Removed: We have formed a cross-functional Cybersecurity Task Force that focuses on long-term cybersecurity strategy.
+Added: We have a cross-functional Cybersecurity Task Force that focuses on long-term cybersecurity strategy.
The Cybersecurity Task Force is composed of members from the information security, engineering and legal teams and reports to our Chief Technology and Product Officer.
1 unchanged sentence
In addition, the Cybersecurity Task Force reviews the business impact and severity of potential cybersecurity incidents, as reported by our automated systems, utilization of the bug bounty program, and public reports on the threat landscape.
−Removed: For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy and results of operations, see “Risk Factors – Risks Related to Data Security, Privacy and Fraud,” which are incorporated by reference into this Item 1C.
+Added: While no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company, for a discussion of whether and how any such risks are reasonably likely to materially affect the Company, including our business strategy and results of operations and financial condition, see “Risk Factors – Risks Related to Data Security, Privacy and Fraud,” which are incorporated by reference into this Item 1C.
In the three most recently completed fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial.
3 unchanged sentences
The following is a summary of our governance processes related to cybersecurity risk management:
−Removed: Our full Board receives biannual updates on cybersecurity from our Chief Technology and Product Officer (the “CTPO”) or head of cybersecurity (the “ CISO ”) to, among other items, review cybersecurity incidents, review key metrics on our cybersecurity program and related risk management programs, and discuss our cybersecurity programs and goals.
+Added: Our full Board receives annual updates on cybersecurity from our Chief Technology and Product Officer (the “CTPO”) or head of cybersecurity (the “ CISO ”) to, among other items, review cybersecurity incidents, review key metrics on our cybersecurity program and related risk management programs, and discuss our cybersecurity programs and goals.
Our Board also regularly reviews cyber-related risks as part of our enterprise risk management program on a quarterly basis and receives updates from our Internal Audit team on the results of the risk monitoring and mitigation process, as described in more detail above.
5 unchanged sentences
Our CTPO is informed about and monitors the prevention, detection, mitigation and remediation or cybersecurity incidents through the management of and participation in the Company’s Internal Audit team, Incident Response Team and Cybersecurity Task Force, as described above.
−Removed: As discussed above, our CTPO or CISO reports biannually to the full Board and quarterly to the Audit Committee about risks from cybersecurity threats among other cybersecurity related matters.
+Added: As discussed above, our CTPO or CISO reports annually to the full Board and quarterly to the Audit Committee about risks from cybersecurity threats among other cybersecurity related matters.
To the extent a material cybersecurity incident occurs, our CTPO and broader management team would inform the chair of our Audit Committee of the nature, scope and impact of the incident, and involve the other members of the Audit Committee or the full Board as necessary to evaluate the risks and determine next steps.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.