5 unchanged sentences
Our cybersecurity practices are based on industry practices and frameworks such as those established by the International Organization for Standardization and the National Institute of Standards and Technology.
−Removed: We recognize the importance of the secure protection of our employee, customer, supplier and partner data and address material risks from cybersecurity threats through a cross-functional approach focused on preserving the confidentiality, security and availability of the information that we collect and store.
−Removed: We have implemented cybersecurity processes, measures and controls to assist management in our assessment, identification and management of risks from cybersecurity threats.
−Removed: Our Security Operations (“SecOps”) team monitors events, analyzes threats, and coordinates our incident response pursuant to our incident response plan, which includes the process to be followed for reporting of incidents.
−Removed: Our cybersecurity risk management involves identifying information assets and potential threats, followed by assessing and prioritizing risks.
+Added: We recognize the importance of the continued protection of our employee, customer, supplier and partner data and address operational risks from cybersecurity threats through a cross-functional approach focused on preserving the confidentiality, integrity and availability of the information that we collect, process and store.
+Added: We have implemented cybersecurity policies, processes, and controls to assist management in our assessment, identification and management of risks from cybersecurity threats.
+Added: Our Security Operations team scans the infrastructure, monitors events, analyzes threats, and coordinates our incident response pursuant to our incident response plan, which includes the process to be followed for reporting of incidents.
+Added: Our cybersecurity risk management involves identifying information assets, their sensitivity and potential threats, followed by assessing and prioritizing risks.
We employ various tools and techniques like threat modeling, vulnerability scanners, and penetration testing.
−Removed: Based on the assessment, security measures are implemented.
−Removed: We have implemented regular security awareness training programs for employees to educate them on cybersecurity best practices and to recognize phishing attempts.
−Removed: We also assess and manage cybersecurity risks associated with third-party service providers, including those in our supply chain or who have access to our data or systems.
−Removed: Our cybersecurity process is iterative, with regular reviews and updates to help improve and respond to a dynamic and continuously evolving threat landscape.
−Removed: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition under the headings “We may be the victim of business disruptions and security breaches, including cyber-attacks, which could lead to liability or could damage our reputation and financial results” and “We may be subject to information technology failures that could damage our reputation, business operations and financial condition” included as part of our risk factors disclosures in Item 1A.
−Removed: Risk Factors of this Annual Report on Form 10-K.
−Removed: In the last three fiscal years, we have not identified any cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.
+Added: Based on the assessment, security measures are planned, prioritized and implemented.
+Added: We have implemented regular security awareness training programs for employees to educate them on cybersecurity best practices and to recognize social engineering and phishing attempts.
+Added: We also assess and manage cybersecurity risks associated with relevant third-party service providers, including those in our supply chain or who have access to our data or systems.
+Added: Our cybersecurity process is iterative, with regular reviews and updates to help improve and keep abreast of a dynamic and continuously evolving threat landscape.
+Added: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition under the headings “We may be the victim of business disruptions and security breaches, including cyber-attacks, which could lead to liability or could damage our reputation and financial results” and “We may be subject to information technology failures that could damage our reputation, business operations and financial condition” included as part of our risk factors disclosures in “Risk Factors” above.
+Added: In the last three fiscal years, we have not identified material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.
Our Board of Directors is responsible for risk management oversight and has delegated to our Audit Committee oversight responsibility for reviewing the effectiveness of our governance and management of cybersecurity risks.
3 unchanged sentences
Members of management, including the Chief Executive Officer, Chief Financial Officer and Chief Legal Officer may also report directly to the Board of Directors on significant risk management issues, including cybersecurity threats and incidents.
−Removed: We have an Information Security Steering Committee (the “ISSC”), comprised of members of our executive team, our Chief Information Officer, CSO, and Chief Legal Officer.
−Removed: Our CSO, in coordination with the ISSC, works collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.
−Removed: Our SecOps team communicates with and reports to the CSO, enabling the CSO and the ISSC to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.
−Removed: Our CSO has over 25 years of security experience in multiple technology disciplines, including prior work experience leading cybersecurity teams, technology strategies and security architecture.
+Added: We have an Executive Security Steering Council (the “ESC”) comprised of members of our executive team, our Chief Information Officer, and CSO.
+Added: Our CSO, in coordination with the ESC, works collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.
+Added: Our Security Operations, Security Engineering, and Governance teams communicate with and report to the CSO, enabling the CSO and the ESC to monitor the detection, mitigation, and remediation of cybersecurity incidents .
+Added: Our CSO has over 27 years of security experience in multiple relevant technology and leadership disciplines, including prior work experience leading cybersecurity teams, business strategies and security solution architecture.
He also holds several relevant degrees and certifications, including as a Certified Information Systems Security Professional (“CISSP”) and a Certified Secure Software Lifecycle Professional (“CSSLP”), and holds Honors BSc degrees in Computer Science and Physics.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.