3 unchanged sentences
We have implemented various measures across our organization to manage our cybersecurity risks, including implementing systems to identify, prevent, detect, investigate, resolve and recover from cyber security attacks.
−Removed: All employees participate in our security awareness training program, and additional training is required for various roles within the organization.
+Added: All employees participate in our role-based security awareness training program, which includes both coursework and attack simulations.
Employees are trained and encouraged to identify and report security concerns, and cybersecurity is engrained in our culture.
2 unchanged sentences
We conduct regular reviews and tests of our systems and our cybersecurity program, both internally and using consultants and external auditors.
−Removed: These tests include, but are not limited to, vulnerability testing, penetration testing, tabletop exercises, systems recovery tests, assessments and other activities to assess the readiness and effectiveness of our cybersecurity controls and protections.
+Added: These tests include, but are not limited to, vulnerability testing, penetration testing, tabletop exercises, systems recovery tests, assessments, security risk reviews and other activities to assess the readiness and effectiveness of our cybersecurity controls and protections.
Our Information Security program is led by our Chief Information Officer (“CIO”), who reports to our Chief Operating Officer (“COO”).
7 unchanged sentences
We also have processes to oversee and identify such risks from cybersecurity threats associated with our use of third-party service providers.
−Removed: While we have not experienced a material breach , our systems are frequently the target of cyber security attacks intending to steal, misuse, or destroy data, to impact our ability to do business, or otherwise negatively impact us.
+Added: We utilize a combination of internal resources and external managed security service providers to monitor and protect our systems and networks.
+Added: We also leverage third-party incident response capabilities to support our team in the event of a significant cybersecurity incident.
+Added: While we have not experienced a material breach, our systems and employees are frequently the target of cyber security attacks intending to steal, misuse, or destroy data, to disrupt our ability to do business, or otherwise negatively impact us.
+Added: These threats are evolving and growing more sophisticated and targeted as improvements in AI technology continuously transforms the threat environment.
If we did experience a significant disruption in service, theft of data, or other significant attack, it could result in legal claims or proceedings, liability under federal and state laws that protect the privacy of personal information, regulatory penalties, remediation costs, increased cybersecurity costs, loss of revenue or customers, damage to our reputation or competitive position, or other harm to our business.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.