1 unchanged sentence
CYBERSECURITY
−Removed: We maintain a comprehensive cybersecurity program and process for identifying, assessing and managing risks from cybersecurity threats as part of our broader risk management system.
−Removed: Our cybersecurity program is run by a dedicated team of cybersecurity professionals with deep expertise in incident prevention, detection and remediation, led by our Vice President, Information Security (a certified information systems security professional with a degree in computer science and more than 30 years of relevant work experience) and our Chief Operating Officer (a seasoned executive with a degree in industrial systems and decades of product and technology experience, including more than 19 years with the Company).
−Removed: The Information Security team is responsible for identifying, assessing and mitigating cybersecurity vulnerabilities, threats and risks;
+Added: We maintain a comprehensive cybersecurity program and process for identifying, assessing and managing risks from cybersecurity threats as part of our broader enterprise risk management system.
+Added: Our cybersecurity program is run by a dedicated team of cybersecurity professionals with deep expertise in security best practices, security and system engineering, and incident response.
+Added: Our Vice President, Information Security is a Certified Information Systems Security (CISSP) and Certified Information Security Management (CISM) professional with a degree in computer science and more than 30 years of relevant IT experience, including more than 10 years at the Company.
+Added: The Information Security function reports to our Chief Operating Officer, who is a seasoned executive with a degree in industrial systems and decades of product and technology experience, including more than 20 years with the Company.
+Added: The Information Security team is responsible for identifying, assessing and mitigating cybersecurity threats, risks, and vulnerabilities;
evaluating and deploying appropriate security tools;
−Removed: and operating a 24x7 security operations center to promptly detect, remediate and prevent security incidents.
−Removed: The team maintains a comprehensive incident response policy that includes prompt reporting of security incidents to a cross-functional working group (including our Chief Operating Officer, General Counsel, Chief Compliance Officer and other security and privacy personnel) in order to ensure that information required to be disclosed by the Company with respect to security incidents is timely identified and reported.
+Added: and operating a 24x7 security operations center to promptly detect, contain, remediate and prevent security incidents.
+Added: Security incidents are reported to a cross-functional working group that includes our Chief Operating Officer, General Counsel, Chief Compliance Officer and other stakeholders as merited.
We have aligned our information security management system to the International Organization for Standardization ("ISO") 27001 standard and our privacy management system to the ISO 27701 standard.
An outside auditor tests the effectiveness of our security and privacy controls against the ISO 27001 and 27701 standards on an annual basis.
−Removed: We also undergo client security audits and cybersecurity program assessments by outside consultants, and we regularly update our program and processes to incorporate recommendations from auditors, consultants and other experts.
−Removed: Finally, we maintain a third-party risk management process that includes screening and evaluation by the Information Security team of service providers who will have access to our systems or confidential information, in order to identify and manage cybersecurity risks associated with our use of such providers.
+Added: We regularly update our program and processes to incorporate recommendations from auditors and outside security experts.
+Added: We also maintain a third-party risk management process that includes the screening and evaluation of service providers against our security, privacy, and compliance standards.
Our Board of Directors has an active role, as a whole and at the committee level, in overseeing management of our material risks from cybersecurity threats.
2 unchanged sentences
Our executive leadership team is responsible for designing and implementing our enterprise risk management program, with input from our Chief Product Officer, Chief Operating Officer, General Counsel and other security and privacy personnel regarding material risks from cybersecurity threats.
−Removed: The executive leadership team regularly discusses security threat trends;
−Removed: incident trends, including any significant incidents that may arise;
−Removed: risk mitigation;
−Removed: and overall security strategy as part of our enterprise security governance process.
+Added: The executive leadership team regularly discusses security threat trends, incident trends, risk mitigation, and overall security strategy as part of our enterprise security governance process.
We consult with outside counsel as appropriate, including on materiality analyses and disclosure matters, and our senior management makes the final materiality determinations and disclosure and other compliance decisions.
−Removed: Our management apprises our independent public accounting firm of any relevant developments.
+Added: Our management team informs our independent public accounting firm of any relevant developments.
We have experienced, and may in the future experience, cybersecurity incidents.
−Removed: While prior incidents have not materially affected our business strategy, results of operations or financial condition to date, and although our processes are designed to help prevent, detect and mitigate the impact of such incidents, we cannot guarantee that a future security incident would not materially affect our strategy, results of operations or financial condition.
+Added: While prior incidents have not materially affected our business strategy, results of operations or financial condition to date, and although our processes are designed to help prevent, detect, mitigate, and minimize the impact of such incidents, we cannot guarantee that a future security incident would not materially affect our strategy, results of operations or financial condition.
For more information on our cybersecurity-related risks, see Item 1A , "Risk Factors" of this 10-K.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.