3 unchanged sentences
Accordingly, the Company has designed and implemented an Information Security Program, designed to protect the confidentiality, integrity, and availability of its information systems and data (including nonpublic information in its possession, custody, or control), as well as to comply with privacy and Information Security Program requirements for insurers as set forth in applicable state laws and regulations.
−Removed: As part of the Information Security Program, the Company has implemented an information security and privacy training and awareness program for Root employees, which includes new-hire training, ongoing periodic training and regular phishing simulation and exercises.
−Removed: In addition, the Company has engaged third parties in connection with these processes.
+Added: As part of the Information Security Program, the Company has implemented an information security and privacy training and awareness program for Root employees, which includes new-hire training, ongoing periodic training, security tabletop exercises and regular phishing simulation and exercises.
+Added: In addition, the Company engages third parties as necessary in connection with these processes.
The Company has engaged third parties to perform information security risk assessments and testing on a periodic basis.
−Removed: It also has engaged third parties to provide a variety of services, including providing hosted security products as well as services to support security incident detection and response activities.
+Added: It also has engaged third parties to provide a variety of services, including providing hosted security products as well as services to support cybersecurity incident detection and response activities.
In order to identify and manage risk from third parties, the Company has implemented a third-party cybersecurity risk management program involving the assessment of information security risk related to the third-party, with consideration given to the inherent risk level, the adequacy of the third-party’s control environment to mitigate those risks, and areas of residual risk.
The breadth and depth of the assessment activities are designed to be commensurate with the nature and scope of the services provided by the third party.
−Removed: The oversight of the Company’s cybersecurity risk management processes are integrated into the Company’s enterprise risk management process.
+Added: The Company’s cybersecurity risk management processes are integrated into the Company’s enterprise risk management process.
Our board of directors oversees an enterprise-wide approach to risk management, designed to support the achievement of organizational objectives, to improve long-term organizational performance and to enhance stockholder value.
3 unchanged sentences
In particular, our board of directors is committed to the prevention, timely detection and mitigation of the effects of cybersecurity threats or incidents.
−Removed: We have experienced cybersecurity threats to our information technology infrastructure and have experienced cybersecurity incidents that have resulted in threat actors obtaining customer personal information, attempts to breach our systems, fraudulent activity and other incidents.
−Removed: As of the filing of this Annual Report on Form 10-K, we are not aware of any such incidents that have occurred since the beginning of 2024 that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition.
+Added: We have previously experienced cybersecurity threats to our information technology infrastructure and have experienced cybersecurity incidents that have resulted in threat actors obtaining customer personal information, attempts to breach our systems, fraudulent activity and other incidents.
+Added: As of the filing of this Annual Report on Form 10-K, however, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have occurred that have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, results of operations or financial condition.
However, future threats could materially affect our business strategy, results of operations or financial condition.
−Removed: Risks related to cybersecurity events are detailed in the section of this Annual Report on Form 10-K titled “Risk Factors—Risks Related to Our Business—Cybersecurity incidents, or real or perceived errors, failures or bugs in our or our vendors’ systems, or our website or app could impair our operations, compromise our confidential information or our customers’ personal information, damage our reputation and brand, and harm our business, financial condition, operating results and prospects.”
+Added: Risks related to cybersecurity events are detailed in the section of this Annual Report on Form 10-K titled “Risk Factors—Risks Related to Our Business—Cybersecurity incidents, or real or perceived errors, failures or bugs in our or our vendors’ systems, or our website or mobile app could impair our operations, compromise our confidential information or our customers’ personal information, damage our reputation and brand, and harm our business, financial condition, operating results and prospects.”
Cybersecurity Governance
3 unchanged sentences
The board of directors and the Audit, Risk and Finance Committee are informed about these risks through regular reports from the Chief Information Security Officer, or CISO, about the Information Security Program.
−Removed: Additionally, the board of directors is informed of material information security incidents, as needed, by the Computer Security Incident Response Team, which is led by the Company’s General Counsel.
+Added: Additionally, the board of directors is informed of significant cybersecurity incidents, as needed, by the Computer Security Incident Response Team, which is led by the Company’s General Counsel.
The Company’s CISO is responsible for assessing and managing risks from cybersecurity threats.
The Company’s CISO also leads the Information Security group and is responsible for the day-to-day management of the Information Security Program.
−Removed: Katelynn Sandy is the Company’s CISO and reports directly to the Company’s President and Chief Technology Officer.
−Removed: Sandy has an extensive background in cybersecurity, technology, and risk management across a variety of industries, including financial services, healthcare, and technology.
−Removed: Additionally, Ms.
−Removed: Sandy holds various information security certifications.
+Added: Srini Srinivasan is the Company’s CISO and reports directly to the Company’s President and Chief Technology Officer.
+Added: Srinivasan has an extensive background in cybersecurity, technology, and risk management across a variety of industries, including financial services, healthcare, retail, e-commerce and technology.
+Added: Additionally, Mr.
+Added: Srinivasan holds various information security certifications.
The Information Security group, senior leadership and the CISO are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through the Information Security Program.
At least quarterly, the CISO provides updates to the Audit, Risk and Finance Committee, which includes updates on the overall Information Security Program status and compliance, cybersecurity related risks, and recommended changes to the Information Security Program.
−Removed: Senior members of our Information Security and Internal Audit functions also provide detailed, regular reports on information security and privacy to the Audit, Risk and Finance Committee .
+Added: Senior members of our Information Security, Internal Audit and Legal functions also provide detailed, regular reports on information security and privacy to the Audit, Risk and Finance Committee .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.