2 unchanged sentences
Risk Management and Strategy
−Removed: As part of our enterprise risk assessment function, which is led by our Senior Vice President and head of Internal Audit, we have implemented processes to assess, identify and manage the material risks facing the company, including from cyber threats.
+Added: As part of our enterprise risk assessment function, which is led by our Senior Vice President and head of Internal Audit, we have implemented processes to assess, identify and manage the material risks facing us, including from cyber threats.
Our enterprise risk assessment function is part of our overall risk management processes.
−Removed: Our cybersecurity program is built upon internationally recognized frameworks, such as ISO 27001, and maps to standards published by The National Institute of Standards and Technology.
−Removed: We believe that our processes provide us with a comprehensive assessment of potential cyber threats.
+Added: Our cybersecurity program is built upon
+Added: internationally recognized frameworks, such as ISO 27001, and maps to standards published by The National Institute of Standards and Technology.
+Added: We believe that our processes provide us with a reasonable and comprehensive assessment of potential cyber threats.
We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems.
2 unchanged sentences
Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents.
−Removed: In addition, we routinely perform simulations and drills at both a technical and management level.
+Added: In addition, we routinely perform simulations and drills at technical, management and executive levels.
Internally, we have a security awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies.
9 unchanged sentences
Synopsys, Inc., a leader in electronic design automation, to perform our external penetration testing and vulnerability assessment;
−Removed: Recorded Future, one of the world’s largest intelligence companies, and Mandiant, a recognized leader in cyber defense, threat intelligence and incident response services, to provide threat intelligence and analysis services;
−Removed: and Mandiant to augment our incident response ability and provide forensic services.
−Removed: We also purchase insurance to protect us against the risk of cybersecurity breaches.
−Removed: Our Senior Vice President and Treasurer is responsible for our insurance programs and reviews on a regular basis our cyber insurance policies and assesses whether we have appropriate coverage.
−Removed: To date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition.
−Removed: That said, as discussed more fully under “Item 1A – Risk Factors”, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient.
+Added: Recorded Future, one of the world’s largest intelligence companies, and Mandiant, a recognized leader in cyber defense, threat intelligence and incident response services, to provide threat intelligence and analysis services and augment our incident response ability.
+Added: Our Senior Vice President and Treasurer is responsible for our insurance programs and reviews on a regular basis our insurance policies and assesses whether we have appropriate coverage.
+Added: To date, risks from cybersecurity threats have not materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition.
+Added: As discussed more fully under “Item 1A – Risk Factors”, the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient.
Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.
1 unchanged sentence
The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity.
−Removed: The Audit Committee receives regular reports from our Chief Product and Technology Officer, Chief Information Security Officer and the Chief Information Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape.
+Added: The Audit Committee receives regular reports from our Chief Information Security Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape.
Our Senior Vice President and head of Internal Audit reports directly to the Audit Committee and is responsible for reporting to the Committee on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats.
−Removed: The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee.
−Removed: In addition, the Board receives separate presentations on cybersecurity risk from our Chief Product and Technology Officer.
+Added: The Chair of the Audit Committee reports to the Board on cybersecurity risks and other matters reviewed by the Committee.
+Added: In addition, the Board receives separate presentations on cybersecurity risk.
Furthermore, all Board members are invited to attend each Audit Committee meeting and have access to the materials for each Audit Committee meeting.
As a matter of process, the Audit Committee annually reviews, and recommends to the Board its approval of, our information security policy and information security program.
−Removed: Furthermore, on an annual basis, the Board reviews and discusses our technology strategy with our Chief Product and Technology Officer and approves our technology strategic plan.
+Added: Furthermore, on an annual basis, the Board reviews and discusses our technology strategy and strategic plan.
Role of management
−Removed: Our Chief Information Security Officer, together with our Chief Product and Technology Officer and Chief Information Officer, is responsible for the day-to-day management of our cybersecurity risks.
−Removed: We have established a Security Council, which includes our Chief Executive Officer, Chief Commercial Officer, Chief Product and Technology Officer, Chief Information Security Officer, Chief Information Officer, Chief Financial Officer, General Counsel and other senior officers, that meets on at least a quarterly basis to review cybersecurity and information security matters.
−Removed: The Security Council has primary management oversight responsibility for assessing and managing information security, fraud, vendor, data protection and privacy, and cybersecurity risks.
+Added: Our Chief Information Security Officer is responsible for the day-to-day management of our cybersecurity risks.
+Added: To ensure robust oversight, we have established a Security Council comprising senior leaders, including our Chief Executive Officer, Chief Operating Officer, Chief Information Security Officer, Chief Financial Officer, General Counsel and Chief Privacy Officer.
+Added: The Security Counsel meets on at least a quarterly basis to review cybersecurity and information security
+Added: The Security Council has primary management oversight responsibility for assessing and managing risks related to information security, fraud, vendor oversight, data protection and privacy, and cybersecurity .
We have a security incident response framework in place.
3 unchanged sentences
In addition, we validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits.
−Removed: Our Chief Information Security Officer, Chief Product and Technology Officer and Chief Information Officer each have extensive experience in the information technology area.
−Removed: In particular, our Chief Information Security Officer has over twenty years of professional experience in the information security area, including as a result of his service as the director of security, a security architect and a software security engineer at companies such as Squarespace, Verizon Media (Oath), Tumblr, Bridgewater Associates and EMC;
−Removed: our Chief Product and Technology Officer has twenty eight years of professional experience in the information security area;
−Removed: and our Chief Information Officer has twenty three years of professional experience in the information security area.
+Added: Our Chief Information Security Officer has extensive experience in the information technology area, with over twenty years of professional experience in the information security area, including as a result of his service as the director of security, a security architect and a software security engineer at companies such as Squarespace, Verizon Media (Oath), Tumblr, Bridgewater Associates and EMC.
+Added: Our Chief Information Security Officer aims to ensure rigorous oversight and execution of our cybersecurity and information security strategy.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.