3 unchanged sentences
Accordingly, the Company has designed and implemented an Information Security Program, designed to protect the confidentiality, integrity, and availability of its information systems and data (including nonpublic information in its possession, custody, or control), as well as to comply with privacy and Information Security Program requirements for insurers as set forth in applicable state laws and regulations.
−Removed: As part of the Information Security Program, the Company has implemented an information security and privacy training and awareness program for Root employees, which includes new-hire training, ongoing monthly training and regular phishing simulation and exercises.
+Added: As part of the Information Security Program, the Company has implemented an information security and privacy training and awareness program for Root employees, which includes new-hire training, ongoing periodic training and regular phishing simulation and exercises.
In addition, the Company has engaged third parties in connection with these processes.
9 unchanged sentences
In particular, our board of directors is committed to the prevention, timely detection and mitigation of the effects of cybersecurity threats or incidents.
−Removed: We have experienced cybersecurity threats to our information technology infrastructure and have experienced cybersecurity attacks, attempts to breach our systems, fraudulent activity and other similar incidents.
+Added: We have experienced cybersecurity threats to our information technology infrastructure and have experienced cybersecurity incidents that have resulted in threat actors obtaining customer personal information, attempts to breach our systems, fraudulent activity and other incidents.
As of the filing of this Annual Report on Form 10-K, we are not aware of any such incidents that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition.
However, future threats could materially affect our business strategy, results of operations or financial condition.
−Removed: Risks related to cybersecurity events are detailed in the section of this Annual Report on Form 10-K titled “Risk Factors—Risks Related to Our Business—Data security breaches, or real or perceived errors, failures or bugs in our systems, website or app could impair our operations, compromise our confidential information or our customers’ personal information, damage our reputation and brand, and harm our business and operating results.”
+Added: Risks related to cybersecurity events are detailed in the section of this Annual Report on Form 10-K titled “Risk Factors—Risks Related to Our Business—Cybersecurity incidents, or real or perceived errors, failures or bugs in our or our vendors’ systems, or our website or app could impair our operations, compromise our confidential information or our customers’ personal information, damage our reputation and brand, and harm our business, financial condition, operating results and prospects.”
Cybersecurity Governance
3 unchanged sentences
The board of directors and the Audit, Risk and Finance Committee are informed about these risks through regular reports from the Chief Information Security Officer, or CISO, about the Information Security Program.
−Removed: Additionally, the board of directors is informed of material information security incidents, as needed, by the Computer Security Incident Response Team, which is led by the Company’s Chief Legal Officer.
−Removed: The Information Security group and senior leadership are responsible for assessing and managing risks from cybersecurity threats.
−Removed: The Information Security group is led by the Company’s CISO, who is also responsible for the day-to-day management of the Information Security Program.
−Removed: Katelynn Sandy is the Company’s CISO.
+Added: Additionally, the board of directors is informed of material information security incidents, as needed, by the Computer Security Incident Response Team, which is led by the Company’s General Counsel.
+Added: The Company’s CISO is responsible for assessing and managing risks from cybersecurity threats.
+Added: The Company’s CISO also leads the Information Security group and is responsible for the day-to-day management of the Information Security Program.
+Added: Katelynn Sandy is the Company’s CISO and reports directly to the Company’s President and Chief Technology Officer.
Sandy has an extensive background in cybersecurity, technology, and risk management across a variety of industries, including financial services, healthcare, and technology.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.