11 unchanged sentences
These processes vary in scope and maturity across the business and are processes we work to improve.
−Removed: Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our controls.
+Added: Our risk management approach is supplemented by external and internal enterprise risk management assessments and audits, which are designed to test the effectiveness of our controls.
We conduct penetration testing or other application security testing on a periodic basis, and have established an external bug bounty program to allow security researchers to help identify vulnerabilities and weaknesses in our controls and configurations in our systems.
9 unchanged sentences
Our incident response plans also provide that our board of directors and audit committee will be notified in the event of certain cybersecurity incidents.
−Removed: Our CISO, Jim Higgins, has over 30 years of experience in the technology sector, including senior leadership roles in product security, information security engineering, and cloud enterprise.
−Removed: Higgins assisted the Linux Foundation in starting the Open Source Security Foundation to help increase awareness and promote technical solutions to address validation of Open Source software.
−Removed: Higgins has worked in information security at Chevron, Eastman Kodak, and Google, and, mostly recently, spent two years as the CISO of Block, Inc.
−Removed: (formerly Square).
−Removed: Our CISO also regularly meets with our CEO and other senior management, including as part of the cybersecurity incident response process.
+Added: Our CISO, Jeb Boniakowski, has over two decades of experience in the technology sector, including senior roles focused on risk management, application development, and user safety systems.
+Added: Boniakowski joined our security engineering team in 2017, which comprises personnel with a broad range of cybersecurity, information technology, and risk management experience.
+Added: Prior to that, he led engineering teams at several startups in fintech and consumer social media.
+Added: Our CISO also regularly meets with our Chief Executive Officer and other senior management, including as part of the cybersecurity incident response process.
Our CISO, and where appropriate our management team and risk and compliance committee, are informed about and monitor the prevention, detection, mitigation, and remediation of identified cybersecurity incidents, through our security incident response process.
4 unchanged sentences
If a cybersecurity incident is determined to be a material cybersecurity incident, our Security Incident Response Policy and associated plans define the process to file a report regarding the incident with the SEC.
−Removed: Higgins recently announced his intention to depart our company effective February 21, 2025 and, as a result, Eric Young, our Senior Vice President of Engineering, will act as our interim CISO while we conduct a search for a permanent replacement.
−Removed: Young has more than 25 years of experience working in the technology industry across a diverse range of business sectors and since June 2023 has overseen Mr.
−Removed: Higgins and our engineering security team, which comprises personnel with a broad range of experience in cybersecurity, information technology, and risk management.
−Removed: Young’s tenure at Snap, Mr.
−Removed: Young has been involved in our approach in assessing, identifying, and managing security incidents.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.