3 unchanged sentences
Risk Management and Strategy
−Removed: We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical infrastructure, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our employees and customers (“Information Systems and Data”).
−Removed: Sprout Social maintains an overarching security program comprised of several teams including (1) Security Operations, (2) Information Technology, (3) Application Security, (4) Infrastructure Security, and (5) Governance, Risk, and Compliance.
+Added: We implement and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical infrastructure, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our employees and customers (“Information Systems and Data”).
+Added: Sprout Social maintains an overarching security program comprising several teams including (1) Security Operations, (2) Information Technology, (3) Application Security, (4) Infrastructure Security, and (5) Governance, Risk, and Compliance.
Together, these teams help identify, assess and manage the Company’s cybersecurity threats and risks using various methods including, for example, internal and external audits, automated and manual tools, threat assessments for internal and external threats, software and services that identify cybersecurity threats, third party threat assessments, a vulnerability management policy and program, incident response exercises, and evaluating threats reported to us through an external bug bounty program.
Our security program is designed to align with the ISO 27001 (International Organization for Standardization) standard, incorporates elements from the National Institute of Standards and Technology (NIST), and is regularly reviewed and audited by independent external third-party auditors.
−Removed: Depending on the environment, as part of our security program, we have implemented and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a general information security policy, incident response plan and incident response policy, data classification, protection, retention, and destruction policy, server protection and logging standards, vulnerability management program, vendor selection and security standard, business continuity and disaster recovery plan, employee onboarding, offboarding, and access escalation policy, risk management and audit policy, regular penetration testing of certain networks, maintaining industry recognized certifications, cybersecurity insurance, and dedicated cybersecurity staff.
+Added: Depending on the environment, as part of our security program, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example, a general information security policy, incident response plan and incident response policy, data classification, protection, retention, and destruction policy, server protection and logging standards, vulnerability management program, vendor selection and security standard, business continuity and disaster recovery plan, employee onboarding, offboarding, and access escalation policy, risk management and audit policy, regular penetration testing of certain networks, maintaining industry recognized certifications, cybersecurity insurance, and dedicated cybersecurity staff.
Our assessment and management of material risks from cybersecurity threats are integrated into the Company’s overall risk management processes.
For example, cybersecurity risk is addressed as a component of the Company’s enterprise risk management program and identified in the Company’s risk register.
−Removed: Also, the security team works with management to identify, discuss, and prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.
+Added: Also, the security team works with management to help identify, discuss, and prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.
In addition, we use third-party service providers to assist us from time to time in reviewing our policies, standards and procedures, identifying and assessing material risks from cybersecurity threats, and making recommendations to improve our security program, including, for example, professional services firms, external legal counsel, penetration testing firms, cybersecurity consultants, and cybersecurity software providers.
3 unchanged sentences
For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1.
−Removed: Risk Factors in this Annual Report on Form 10-K, including the section of our risk factors titled, “Risks Related to the Use of Technology.”
+Added: Risk Factors in this Annual Report on Form 10-K, including the sections of our risk factors titled “Risks Related to the Use of Technology” and “Legal and Regulatory Risks.”
Our overarching security program, enterprise-wide cybersecurity strategy, risk management program, and related security policies, standards, and processes are managed by the Vice President of Information Technology, Security, and Compliance and the Chief Technology Officer.
They are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s business strategy, communicating key priorities to relevant personnel, approving budgets, preparing for cybersecurity incidents, approving cybersecurity policies, and reviewing internal and external security assessments and other security-related reports.
−Removed: They also report on our risk management program, overall security posture, progress on maturing the security program, and new or emerging risks to senior management and the Board of Directors as applicable and on a regular basis.
+Added: They also report on our risk management program, overall security posture, progress on maturing the security program, and new or emerging risks to senior management and the Board of Directors.
Our Board of Directors addresses the Company’s cybersecurity risk management as part of its general oversight function.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.