9 unchanged sentences
The Company assesses, identifies and manages cybersecurity related risks.
−Removed: Cybersecurity related risks are evaluated to assess top risks to the enterprise on a bi-annual basis.
+Added: Cybersecurity related risks are continuously evaluated to assess top risks to the enterprise.
SoundHound has implemented a comprehensive cybersecurity program designed to identify, assess, and manage cyber risks.
6 unchanged sentences
These policies go through an annual internal review process and are approved by appropriate members of management.
−Removed: We have continued to expand investments in IT security, including additional end-user training, using layered defenses, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts.
−Removed: We regularly test defenses by performing simulations and drills at both a technical level and by reviewing our operational policies and procedures.
−Removed: We review our operational policies and procedures with third party experts on an annual basis as part of our annual audit process.
+Added: We have continued to expand investments in our overall security posture, including additional end-user training, using defense in depth, identifying and protecting critical assets, strengthening monitoring and alerting, and engaging experts.
+Added: We regularly test our defenses through simulations, both at the technical level and through reviews of our operational policies and procedures.
+Added: We review our operational policies and procedures with third-party experts as part of our annual audit process.
We also maintain cyber insurance coverage.
In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers.
−Removed: Our Vendor Management Team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties.
−Removed: The internal business owners of the hosted applications are required to document user access reviews at least annually and provide from the vendor a System and Organization Controls (SOC) 1 or SOC 2 report.
−Removed: If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis.
+Added: We conduct an annual review of third-party hosted applications with a specific focus on any sensitive data.
+Added: We perform user access reviews on all third-party applications.
+Added: We obtain compliance reports, such as SOC 1 and SOC 2, from all critical third-party vendors annually.
+Added: If a third-party vendor is not able to provide compliance reports, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis.
Our assessment of risks associated with use of third-party providers is part of our overall cybersecurity risk management framework.
27 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.