2 unchanged sentences
We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K.
−Removed: These material risks are managed across Riot, our subsidiaries, and third-party contractors, and monitoring such risks and threats is integrated into our overall risk management program.
+Added: These material risks are managed across Riot, our subsidiaries, and third-party
+Added: contractors, and monitoring such risks and threats is integrated into our overall risk management program.
Our risk management program is comprised of, among other things, policies that are designed to identify, assess, manage, and mitigate cybersecurity risk, and is based on applicable laws and regulations, informed by industry standards and best practices.
4 unchanged sentences
In support of our risk management program, we have adopted an Information Security Policy (the “Info-Sec Policy”) and an Incident Response Plan (the “Response Plan”) that establish administrative, physical, and technical controls and procedures to protect the integrity, confidentiality, and accessibility of sensitive data that may exist throughout the Company as well as processes to assess, identify, manage, and report cybersecurity risks and incidents.
−Removed: Our Info-Sec Policy applies to all persons working for the Company, as well as any third parties working with Riot in any capacity.
+Added: Our Info-Sec Policy applies to all persons working for the Company, as well as any third parties working with us in any capacity.
Violation of our Info-Sec Policy may result in revocation of access privileges, and disciplinary action up to and including termination of employment or service relations for third parties.
6 unchanged sentences
Additionally, we use a Security Information and Event Management (SIEM) system, which allows us to store logs off the system of record to prevent log tampering and provides the cybersecurity team functionality to build alerts on specific use cases that are important and unique to our business.
−Removed: If our applications fail or our software does not successfully block a malicious electronic communication, employees are required to notify an immediate supervisor or the cybersecurity team promptly, but in no circumstances later than twenty-four (24) hours after such occurrence.
−Removed: Our board of directors has ultimate oversight of our strategic and business risk management and, as such, has oversight responsibilities for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks.
−Removed: Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing and updating processes to ensure such potential risks are monitored, putting in place appropriate mitigation measures, and providing regular reports on cybersecurity trends and risks, and should they arise, any material incidents with our board of directors.
−Removed: Our Chief Financial Officer is responsible for our cybersecurity program, and our Manager of Cybersecurity is our incident response team leader.
−Removed: In this position, our Manager of Cybersecurity oversees our cybersecurity team, and guides our incident response team, which is comprised of members from across our organization, including cybersecurity, IT support, mining operations, software engineering, compliance and legal, as well as contractors and other partners, as they support our cybersecurity functions.
−Removed: Our Manager of Cybersecurity has nearly two decades of experience in cybersecurity management and policy, achieved through job training, higher education, and military experience, and possesses a background in security and alignment of information technology solutions.
−Removed: Our Response Plan, developed by management and our cybersecurity team, and IT support team, serves as a Company-wide guide to facilitate coordinated, prompt, and systematic responses to any cybersecurity incidents and utilizes four interconnecting phases:
+Added: We also implement robust network security protections and enterprise hardware for firewalls to safeguard our infrastructure against unauthorized access and cyber threats.
+Added: Our strategy for 2025 includes leveraging AI and machine learning for enhanced threat detection and response, adopting a Zero Trust architecture, and using quantum-resistant encryption methods for data protection.
+Added: We also focus on ransomware defense, regular backup and recovery processes, and continuous employee training and awareness programs.
+Added: Additionally, we ensure compliance with the latest regulations, participate in threat intelligence sharing, and explore emerging technologies like post-quantum cryptography and blockchain security.
+Added: If our applications fail or our software does not successfully block malicious electronic communications, employees are required to notify an immediate supervisor or the cybersecurity team promptly, but in no circumstances later than twenty-four (24) hours after such occurrence.
+Added: Our Board has ultimate oversight of our strategic and business risk management and, as such, has oversight responsibilities for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks.
+Added: The Board has delegated to the Audit Committee oversight risks of cybersecurity risk policies, practices and procedures.
+Added: Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing and updating processes to ensure such potential risks are monitored, putting in place appropriate mitigation measures, and providing regular reports on cybersecurity trends and risks, and should they arise, any material incidents with our Board.
+Added: Our Chief Financial Officer is responsible for our cybersecurity program, and our Director of Cyber Security is our incident response team leader.
+Added: In this position, our Director of Cyber Security oversees our cybersecurity team, and guides our incident response team, which is comprised of members from across our organization, including cybersecurity, IT support, mining operations, software engineering, compliance and legal, as well as contractors and other partners, as they support our cybersecurity functions.
+Added: Our Director of Cyber Security has nearly two decades of experience in cybersecurity management and policy, achieved through job training, college education, and work in security and alignment of information technology solutions.
+Added: The Response Plan, developed by management and our cybersecurity team, and IT support team, serves as a Company-wide guide to facilitate coordinated, prompt, and systematic responses to any cybersecurity incidents and utilizes four interconnecting phases:
(1) Preparation;
4 unchanged sentences
Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to executive management.
−Removed: Determination of what resources are needed to address the incident, prioritizing of response activities, forming of action plans, and notification of external parties as needed are then undertaken by executive management and the cross-functional working group, led by our Chief Financial Officer and Manager of Cybersecurity.
+Added: Determination of what resources are needed to address the incident, prioritizing of response activities, forming of action plans, and notification of external parties as needed are then undertaken by executive management and the cross-functional working group, led by our Chief Financial Officer and Director of Cyber Security.
We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive management makes the final materiality and disclosure determinations, among other compliance decisions.
−Removed: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.
+Added: During 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy , results of operations or financial condition.
However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurances that undetected cybersecurity incidents have not occurred.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.