20 unchanged sentences
For instance, we have routinely engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis.
−Removed: In addition, we have engaged:
−Removed: Novacoast, an international cybersecurity company specializing in IT services and software development, to augment our monitoring and detection efforts;
−Removed: Synopsys, Inc., a leader in electronic design automation, to perform our external penetration testing and vulnerability assessment;
−Removed: Recorded Future, one of the world’s largest intelligence companies, and Mandiant, a recognized leader in cyber defense, threat intelligence and incident response services, to provide threat intelligence and analysis services and augment our incident response ability.
−Removed: Our Senior Vice President and Treasurer is responsible for our insurance programs and reviews on a regular basis our insurance policies and assesses whether we have appropriate coverage.
+Added: We have also engaged various third-party experts to, among other things:
+Added: augment our monitoring and detection efforts;
+Added: perform our external penetration testing and vulnerability assessment;
+Added: provide threat intelligence and analysis services and augment our incident response capabilities.
+Added: Additionally, our Senior Vice President and Treasurer reviews on a regular basis our insurance programs and policies to ensure we have appropriate coverage.
To date, risks from cybersecurity threats have not materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition.
4 unchanged sentences
The Audit Committee receives regular reports from our Chief Information Security Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape.
−Removed: Our Senior Vice President and head of Internal Audit reports directly to the Audit Committee and is responsible for reporting to the Committee on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats.
−Removed: The Chair of the Audit Committee reports to the Board on cybersecurity risks and other matters reviewed by the Committee.
−Removed: In addition, the Board receives separate presentations on cybersecurity risk.
−Removed: Furthermore, all Board members are invited to attend each Audit Committee meeting and have access to the materials for each Audit Committee meeting.
−Removed: As a matter of process, the Audit Committee annually reviews, and recommends to the Board its approval of, our information security policy and information security program.
−Removed: Furthermore, on an annual basis, the Board reviews and discusses our technology strategy and strategic plan.
+Added: Our Vice President and head of Internal Audit reports directly to the Audit Committee and is responsible for reporting to the Audit Committee on our company-wide enterprise risk assessment, which includes an evaluation of cyber risks and threats.
+Added: The Chair of the Audit Committee reports to the board of directors on cybersecurity risks and other matters reviewed by the Audit Committee.
+Added: In addition, the board of directors receives separate presentations on cybersecurity risk.
+Added: Furthermore, all members of the board of directors are invited to attend each Audit Committee meeting and have access to the materials for each Audit Committee meeting.
+Added: As a matter of process, the Audit Committee annually reviews, and recommends to the b oard of directors its approval of, our information security policy and information security program.
+Added: Furthermore, on an annual basis, the board of directors reviews and discusses our technology strategy and strategic plan.
Role of management
1 unchanged sentence
To ensure robust oversight, we have established a Security Council comprising senior leaders, including our Chief Executive Officer, Chief Operating Officer, Chief Information Security Officer, Chief Financial Officer, General Counsel and Chief Privacy Officer.
−Removed: The Security Counsel meets on at least a quarterly basis to review cybersecurity and information security
+Added: The Security Council meets on at least a quarterly basis to review cybersecurity and information security matters.
The Security Council has primary management oversight responsibility for assessing and managing risks related to information security, fraud, vendor oversight, data protection and privacy, and cybersecurity .
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.