4 unchanged sentences
Malicious actors are increasingly sophisticated in their methods, tactics, techniques, and procedures, seeking to steal money, gain unauthorized access to, destroy or manipulate data, and disrupt operations.
−Removed: As of the date of this report, we have not identified any cybersecurity threats or cybersecurity incidents that have materially a ffected or are reasonably anticipated to have a material adverse effect on our business.
+Added: Based on information known to management through our established processes and policies as of the date of this report, we have not identified any cybersecurity threats or cybersecurity incidents that have materially affected or are reasonably anticipated to have a material adverse effect on our business.
However, we have experienced and expect to continue to experience cybersecurity threats and cybersecurity incidents.
−Removed: As an example, in December 2022, we previously disclosed a ransomware incident that caused service disruptions for our Hosted Exchange customers.
−Removed: We are committed to maintaining robust governance and oversight of cybersecurity risks and implementing recognized industry best practices to help prevent, detect, mitigate and respond to these risks;
−Removed: however, we cannot provide assurance that cybersecurity risks will not materially affect our business in the future, including our business strategy, results of operations, or financial condition or that our controls, processes and procedures will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems.
−Removed: Cybersecurity threats, whether or not successful, could result in our incurring significant costs related to rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm.
−Removed: In addition, these threats are constantly evolving, thereby increasing the difficulty of successfully defending against them or implementing adequate preventative measures.
−Removed: We have seen an increase in cyberattack volume, frequency and sophistication.
−Removed: See " Risk Factors - Security breaches, cyber-attacks and other interruptions to our or our third-party service providers’ infrastructure have disrupted and may continue to disrupt our internal operations and we may be exposed to claims and liability, lose customers, suffer harm to our reputation, lose business-critical compliance certifications and incur additional costs.
−Removed: " for more information on our cybersecurity risks.
+Added: In December 2022, we previously disclosed a ransomware incident that caused service disruptions for our Hosted Exchange customers.
+Added: In addition, in March 2025, a malicious actor publicly claimed to have gained unauthorized access to certain of our data, but after investigation and forensic analysis, we found no evidence of unauthorized access and did not correlate the data shared by the malicious actor to us or any of our customers.
+Added: We maintain governance and oversight processes designed to manage cybersecurity risks and implement controls and practices intended to identify, protect, detect, respond to and recover from cybersecurity risks and incidents;
+Added: however, we cannot provide assurance that cybersecurity risks will not materially affect our business (or the systems we host for our customers) in the future, including our business strategy, results of operations, or financial condition, nor can we provide assurance that our controls, processes and procedures will operate as intended in all circumstances.
+Added: Cybersecurity threats, whether or not successful, could result in significant costs related to rebuilding our internal systems, writing down inventory value, implementing additional threat protection measures, providing modifications or replacements to our products and services, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as significant reputational harm.
+Added: Cybersecurity threats continue to evolve, including with the advent of AI and GenAI, which may increase the difficulty of detecting and defending against such threats.
+Added: See "Risk Factors - Security breaches, cyber-attacks and other interruptions to our or our third-party service providers’ infrastructure have disrupted and may continue to disrupt our internal operations and we may be exposed to claims and liability, lose customers, suffer harm to our reputation, lose business-critical compliance certifications and incur additional costs." for more information on our cybersecurity risks.
Risk Management and Strategy
−Removed: Cybersecurity risk management is a component of the company’s broader enterprise risk management program and we have established cybersecurity policies and procedures to protect against and mitigate harm from cybersecurity incidents.
−Removed: We respond to cybersecurity incidents in accordance with our cybersecurity policies and procedures and applicable law.
−Removed: Rackspace maintains a cross-functional approach to cybersecurity risk, which is designed to help prevent, identify, assess, manage, mitigate, and respond to cybersecurity threats.
−Removed: Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies, and other processes to assess, identify, manage and address material cybersecurity risks.
+Added: Cybersecurity risk management is a component of our broader enterprise risk management program, and we have established cybersecurity policies and procedures to identify, protect, detect, respond to and recover from cybersecurity risks and incidents in accordance with applicable law.
+Added: We maintain a cross-functional approach to cybersecurity risk, which is designed to help identify, protect, detect, respond to and recover from cybersecurity threats.
+Added: Our cybersecurity strategy focuses on implementation of controls, technologies, and other processes designed to assess, identify, manage and address material cybersecurity risks.
These include, among other things:
1 unchanged sentence
mechanisms to detect and monitor unusual network activity;
+Added: processes to model the integrity of critical security controls;
+Added: enforcement of computing system security policies;
and containment and incident response tools.
We monitor issues that are internally discovered or externally reported that may affect our operations, systems, network, data, products and/or services, and have processes to assess those issues for potential cybersecurity impact or risk.
−Removed: We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats.
−Removed: Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.
−Removed: Our cybersecurity policies and procedures include incident response plans which guide our employees, senior management, the Audit Committee and the Board on our response to cybersecurity incidents, including escalation processes, as appropriate.
+Added: We assess and deploy technical safeguards intended to protect our information systems from cybersecurity threats.
+Added: These safeguards may be evaluated and updated based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.
+Added: Our cybersecurity policies and procedures include incident response plans that address roles, responsibilities, and escalation protocols in connection with cybersecurity incidents, as appropriate.
Our team engages with external cybersecurity advisors and experts, including outside counsel and outside cybersecurity firms, assessors, auditors and consultants as necessary or appropriate.
−Removed: We also maintain numerous industry-related compliance certifications for various aspects of our business, such as International Organization for Standardization ("ISO") 27001, Service Organization Controls ("SOC 1, 2, 3") and Payment Card Industry ("PCI"), Federal Information Security Management Act ("FISMA"), Federal Risk and Authorization Management Program ("FedRAMP") and Health Information Trust Alliance (“HITRUST”) in the U.S., Information Security Registered Assessors Program ("IRAP") in Australia and Public Services Network ("PSN") in the U.K.
+Added: We also maintain numerous industry-related compliance certifications for various aspects of our business.
+Added: These certifications and attestations apply to specified systems, services or processes and do not eliminate cybersecurity risk.
+Added: In addition, they are point-in-time references and do not guarantee future performance.
Our cybersecurity policies and procedures are designed to vet key third-party providers and provide for oversight and cooperation regarding cybersecurity incidents.
−Removed: In addition, our cybersecurity policies and procedures require our third-party providers to meet appropriate security requirements and we investigate security incidents that have impacted our third-party providers, as appropriate;
−Removed: however, our ability to monitor our third-party service providers’ data security is limited.
+Added: In addition, our cybersecurity policies and procedures require our third-party providers to meet appropriate security requirements.
+Added: We may investigate security incidents that have impacted our third-party providers, as appropriate;
+Added: however, our ability to monitor our third-party service providers’ data security is limited, consistent with industry practices.
Board Oversight
The Audit Committee of our Board oversees our cybersecurity risk.
−Removed: The Audit Committee receives regular cybersecurity specific updates from management (including our CSO and/or other key personnel), typically on a quarterly basis, about the prevention, detection, mitigation, and remediation of cybersecurity threats and cybersecurity incidents, as well as the evolving cybersecurity landscape, recent program enhancements and other relevant topics.
−Removed: The Audit Committee reports to our Board and a number of our Audit Committee and Board members have experience in assessing and managing cybersecurity risks.
+Added: The Audit Committee receives regular cybersecurity specific updates from management (including our Chief Information Security Officer ("CISO") and/or other key personnel), typically on a quarterly basis, about the identification, protection, detection, response and recovery from cybersecurity threats and cybersecurity incidents, as well as the evolving cybersecurity landscape and trends, notable incidents, recent program enhancements and other relevant topics.
+Added: The nature and timing of information provided depends on the circumstances and materiality of the underlying risk or incident.
+Added: The Audit Committee reports to our Board and certain of our Audit Committee and Board members have experience in assessing and managing cybersecurity risks.
In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated to the Audit Committee and/or the Board on an as-needed basis.
Management’s Role
−Removed: Our CSO leads our overall cybersecurity function and supervises our cybersecurity team’s efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents.
−Removed: She provides regular updates directly to the Audit Committee, typically on a quarterly basis.
−Removed: She has over 20 years of experience in information security leadership positions, including with large technology and healthcare companies as well as several large financial institutions.
−Removed: She holds a Bachelor of Science from Arizona State University and has been with us since 2019.
−Removed: Our CSO reports to our President – Artificial Intelligence, Technology and Sustainability, who has been a Chief Information Officer or Chief Technology Officer of two other large publicly traded companies.
−Removed: He provides overall leadership and guidance for the company’s technology department, including the cybersecurity team.
−Removed: He holds a Master of Business Administration in international business from The Ohio State University, a Master of Computer Applications in computer science from the University of Mumbai, a Bachelor of Science in physics from the University of Madras and has been with us since 2021.
−Removed: Key security, risk, and compliance personnel across a cross-functional group of internal stakeholders, including senior management, meet regularly to develop and continually evaluate our cybersecurity policies and procedures, including discussions of the following:
+Added: Our overall cybersecurity function and oversight of our cybersecurity team’s efforts to identify, protect, detect, respond to and recover from cybersecurity risks and incidents is led by our CISO, who joined in March 2026.
+Added: Our CISO is an experienced cybersecurity executive who has served as Chief Information Security Officer and Chief Security Officer for a global e-commerce platform, previously held senior leadership roles across technology and financial services organizations, including leading a major post-breach security recovery.
+Added: He is responsible for governance, compliance, risk management, enterprise security transformation, and operational efficiency initiatives.
+Added: Our CISO is supported by our Deputy CISO, who brings more than 15 years of experience in enterprise security, risk, and emerging technologies.
+Added: He served in senior leadership roles including Deputy Chief Technology Officer and Head of Information Security, holds graduate degrees in Computer Science and Business Administration, and is CISSP-credentialed.
+Added: He began his career in secure communications and cryptographic systems as a uniformed member of the United States Air Force.
+Added: Our CISO and Deputy CISO lead a team of cybersecurity professionals who have extensive experience across multiple sectors, many of whom hold relevant industry certifications.
+Added: Key security, risk, technology, legal, and compliance personnel, together with other cross-functional internal stakeholders and senior management, meet regularly with the cybersecurity team to develop, review and evaluate our cybersecurity policies and procedures, including discussions of the following:
• cybersecurity strategies for preservation of the confidentiality, integrity and availability of company and customer information;
−Removed: • identification, prevention and mitigation of cybersecurity threats and incidents;
−Removed: • effective response to cybersecurity incidents (including escalation procedures of certain cybersecurity incidents so that decisions regarding public disclosure and other required reporting can be made by the appropriate personnel in a timely manner).
+Added: • identification, protection, detection, response and recovery from cybersecurity threats and incidents;
+Added: • effective response to cybersecurity incidents (including escalation procedures to enable timely decisions regarding public disclosure and other required reporting by appropriate personnel).
+Added: Under our global incident response process, cybersecurity incidents are assessed and classified by severity, and incidents are escalated as appropriate to executive leadership.
+Added: In addition, we have a process to promptly notify the Audit Committee and the Board , as appropriate, in the event a cybersecurity incident may be material.
+Added: Materiality determinations are made in accordance with our disclosure controls and procedures.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.