6 unchanged sentences
To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.
−Removed: Our Technology Risk Management Committee, which is comprised of representatives from our business operations and support functions (e.g., legal, finance, internal audit, commercial, privacy), assesses risks based on probability and potential impact to key business systems and processes.
−Removed: Risks that are considered high are incorporated into our overall risk management program.
−Removed: A mitigation plan is developed for each identified high risk, with progress reported to the Technology Risk Management Committee and tracked as part of our overall risk management program overseen by the Audit Committee of our board of directors.
+Added: Our Technology Risk Management Committee, which is comprised of representatives from our business operations and support functions (e.g., legal, finance, internal audit, commercial, privacy), assesses cybersecurity risks based on probability and potential impact to key business systems and processes.
+Added: Cybersecurity risks that are considered high are incorporated into our overall risk management program.
+Added: A mitigation plan is developed for each identified high risk, with progress on risk mitigation reported to the Technology Risk Management Committee and tracked as part of our overall risk management program, which is overseen by the Audit Committee of our board of directors.
We collaborate with third parties to assess the effectiveness of our cybersecurity prevention and response systems and processes.
These include cybersecurity assessors, consultants, and other external cybersecurity experts to assist in the identification, verification, and validation of cybersecurity risks, as well as to support associated mitigation plans when necessary.
−Removed: developed a third-party cybersecurity risk management process to conduct due diligence on external entities, including those that perform cybersecurity services.
−Removed: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected our Company, including our business strategy, results of operations, or financial condition.
−Removed: We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our Company.
+Added: developed a process to conduct due diligence on third parties with which we work to oversee and identify material risks from cybersecurity threats associated with our use of those third parties' services, including those that perform cybersecurity services.
+Added: To date, the Company is not aware of risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.
Refer to the risk factor captioned " Significant disruptions of information technology systems or breaches of data security could adversely affect our business " in Part I, Item 1A.
−Removed: "Risk Factors" for additional description of cybersecurity risks and potential related impacts on our Company.
+Added: "Risk Factors" for additional information regarding cybersecurity risks and potential related impacts on our Company.
Our board of directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees.
5 unchanged sentences
The Company's Chief Information Security Officer ("CISO"), in coordination with the Chief Information Officer and the Technology Risk Management Committee, is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks .
−Removed: The current CISO has over 35 years of experience in information security and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties.
−Removed: The CISO provides periodic updates on our cybersecurity risk profile to management's Technology Risk Management Committee, the Audit Committee of our board of directors, and the Audit Committee chair.
+Added: The current CISO has over 35 years of experience in technology and information security, including operating in the role of the CISO for several large companies in the pharmaceutical and healthcare industries, and possesses the requisite education, skills, experience, and industry certifications expected of an individual assigned to these duties.
+Added: The CISO provides periodic updates on our cybersecurity risk profile to management's Technology Risk Management Committee and the Audit Committee of our board of directors.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.