8 unchanged sentences
• maintaining cybersecurity incident management procedures to address incident reporting, classification, escalation, response, and recovery, and facilitate efficient and consistent management of cybersecurity incidents involving our information systems;
−Removed: • assessing and testing our cybersecurity policies and practices via internal efforts (such as assessments, vulnerability testing, threat modeling, tabletop exercises, and other exercises focused on evaluating the effectiveness of our cybersecurity measures) and by engaging third parties (including cybersecurity consulting firms) to perform assessments of our cybersecurity measures;
−Removed: • a third-party cybersecurity risk management process, including, among other things, a security assessment and contracting process for vendor applications and implementing contractual security measures with third-party vendors;
−Removed: • cybersecurity awareness training for all employees and enhanced training for certain employees.
+Added: • assessing and testing our cybersecurity policies and practices via internal efforts (such as assessments, vulnerability testing, threat modeling, tabletop exercises, and other exercises focused on evaluating the effectiveness of our cybersecurity measures) and by engaging third parties (including cybersecurity consulting firms) to perform assessments of our cybersecurity measures and manage our bug bounty program;
+Added: • a cybersecurity risk management process for third-party vendors, including, among other things, a security assessment and contracting process for vendor applications and implementing contractual security measures with third-party vendors;
+Added: • cybersecurity awareness training is available for all employees and enhanced training is provided for certain employees.
Cybersecurity Governance
1 unchanged sentence
As reflected in its charter, the Audit Committee assists the Board in reviewing our significant cybersecurity matters and concerns.
−Removed: The Audit Committee engages on cybersecurity matters with our management team, including our Vice President of Trust Engineering, who regularly provides presentations to the Audit Committee on our cybersecurity program and cybersecurity risks.
+Added: The Audit Committee engages on cybersecurity matters with our management team, including our Vice President of Product and Enterprise Security, who regularly provides presentations to the Audit Committee on our cybersecurity governance and compliance programs.
These presentations address a range of topics including, for example, the threat landscape and cybersecurity events, vulnerability assessments, incident preparedness assessments, disaster recovery plans, and cybersecurity awareness training.
1 unchanged sentence
In addition, the full Board receives regular updates on the activities of the Audit Committee, including with regard to cybersecurity oversight.
−Removed: Our Vice President of Trust Engineering is principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of management.
−Removed: Our Vice President of Trust Engineering has served in various roles in cybersecurity and information technology for over 30 years, including as Vice President and Chief Security Architect of Intertrust Technologies Corporation and Java Security Architect at Sun Microsystems, Inc.
−Removed: In addition, our Executive Incident Management Team (“EIMT”) is a cross-functional management committee focused on providing executive guidance on the cybersecurity incident response process to facilitate an appropriate and timely response, make decisions related to cybersecurity incidents, and notify appropriate parties with relevant cross-functional expertise in the event of a cybersecurity incident.
−Removed: Our Trust Engineering team is responsible for the day-to-day identification, assessment, and management of information security risks and provides regular updates to our Vice President of Trust Engineering regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.
−Removed: Cybersecurity incidents are escalated to our Vice President of Trust Engineering, the EIMT, and the Chair of our Audit Committee in accordance with our cybersecurity incident management procedures, so that decisions can be made regarding incident reporting and disclosure in a timely manner.
+Added: Our Vice President of Product and Enterprise Security is principally responsible for overseeing our cybersecurity risk management program, in partnership with other members of management.
+Added: Our Vice President of Product and Enterprise Security has over 30 years of experience in cybersecurity and information technology roles, including executive leadership positions at public and private companies.
+Added: In addition, our Executive Incident Management Team (“EIMT”) is a cross-functional management committee dedicated to providing executive-level guidance on the cybersecurity incident response process to facilitate an appropriate and timely response, make decisions related to cybersecurity incidents, and notify appropriate parties with relevant cross-functional expertise in the event of a cybersecurity incident.
+Added: Our Product and Enterprise Security team is responsible for the day-to-day identification, assessment, and management of information security risks and provides regular updates to our Vice President of Product and Enterprise Security regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.
+Added: Cybersecurity incidents are escalated to our Vice President of Product and Enterprise Security, the EIMT, and the Chair of our Audit Committee in accordance with our cybersecurity incident management procedures, so that decisions can be made regarding incident reporting and disclosure in a timely manner.
Notwithstanding our cybersecurity risk management and governance, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.
While our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents.
−Removed: For more information regarding the cybersecurity risks we face, see Item 1A, Risk Factors, elsewhere in this Annual Report, under the caption “Significant disruptions of our information technology systems or data security incidents could harm our reputation, cause us to modify our business practices, and otherwise adversely affect our business and subject us to liability.”
+Added: For more information regarding the cybersecurity risks we face, see Item 1A, Risk Factors, elsewhere in this Annual Report, under the caption “Data security incidents, including cybersecurity attacks, or other significant disruptions of our information technology systems could harm our reputation, cause us to modify our business practices, and otherwise adversely affect our business and subject us to liability.”
+Added: Legal Proceedings
+Added: Information with respect to this item may be found in Note 12 to the consolidated financial statements in Item 8 of this Annual Report, which is incorporated herein by reference.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.