4 unchanged sentences
The scope of cybersecurity risk management encompasses all aspects of business operations, including supply chain risks and production manufacturing operations.
−Removed: Our cybersecurity practices are based on industry practices and frameworks such as those established by the International Organization for Standardization and the National Institute of Standards and Technology.
−Removed: We recognize the importance of the continued protection of our employee, customer, supplier and partner data and address operational risks from cybersecurity threats through a cross-functional approach focused on preserving the confidentiality, integrity and availability of the information that we collect, process and store.
+Added: We maintain an information security management system (“ISMS”) that is certified to ISO/IEC 27001:2022.
+Added: Our ISO/IEC 27001:2022 certification covers the broadest scope of information security management and information cyber risk management, including all aspects of semiconductor hardware and software design, development, validation and quality assurance, operations, manufacturing, and technology supply chain risk management.
+Added: We recognize the importance of the continued protection of our employee, customer,
+Added: supplier and partner data and address operational risks from cybersecurity threats through a cross-functional approach focused on preserving the confidentiality, integrity and availability of the information that we collect, process and store.
We have implemented cybersecurity policies, processes, and controls to assist management in our assessment, identification and management of risks from cybersecurity threats.
6 unchanged sentences
Our cybersecurity process is iterative, with regular reviews and updates to help improve and keep abreast of a dynamic and continuously evolving threat landscape.
+Added: In addition, we operate a Secure Software Maturity Framework (“SSMF”) program that is intended to provide a structured, risk-based framework for identifying, assessing and mitigating security risks across the lifecycle of our software components, products and related manufacturing services and operational processes.
+Added: Through the SSMF program, we seek to integrate “security-by-design” requirements into product and process design, validation and quality assurance, operations and supply chain activities;
+Added: perform periodic assessments of critical assets and suppliers;
+Added: and track remediation of identified issues to completion.
+Added: The SSMF program is designed to align with, and complement, our ISO/IEC 27001:2022-certified ISMS and other elements of our enterprise risk management program.
We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition under the headings “We may be the victim of business disruptions and security breaches, including cyber-attacks, which could lead to liability or could damage our reputation and financial results” and “We may be subject to information technology failures that could damage our reputation, business operations and financial condition” included as part of our risk factors disclosures in “Risk Factors” above.
−Removed: In the last three fiscal years, we have not identified material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.
+Added: To date, we have not identified material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.
Our Board of Directors is responsible for risk management oversight and has delegated to our Audit Committee oversight responsibility for reviewing the effectiveness of our governance and management of cybersecurity risks.
−Removed: The Audit Committee regularly reviews our policies and practices with respect to risk management, including cybersecurity risks, and reports to the full Board of Directors based on these reviews.
+Added: The Audit Committee regularly reviews our policies and practices with respect to risk management, including cybersecurity risks, our ISO/IEC 27001:2022-certified ISMS and our SSMF program, and reports to the full Board of Directors based on these reviews.
The Audit Committee also receives a report containing information security risk posture details, remediation plan execution progress and pertinent threat intelligence updates from the Chief Security Officer (“CSO”) on a quarterly basis.
2 unchanged sentences
We have an Executive Security Steering Council (the “ESC”) comprised of members of our executive team, our Chief Information Officer, and CSO.
−Removed: Our CSO, in coordination with the ESC, works collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.
+Added: Our CSO, in coordination with the ESC, works collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes, including oversight of our ISMS and SSMF programs.
Our Security Operations, Security Engineering, and Governance teams communicate with and report to the CSO, enabling the CSO and the ESC to monitor the detection, mitigation, and remediation of cybersecurity incidents .
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.