3 unchanged sentences
Cybersecurity Governance and Oversight
−Removed: Bio-Techne’s cybersecurity program is led by the Company’s Chief Information Security Officer (“CISO”), with day-to-day management and administration of our cybersecurity program performed by the IT Security Operations team.
−Removed: The CISO reports to the Chief Information Officer (“CIO”), and the CIO reports to the Chief Executive Officer.
−Removed: The CISO is supported by the Incident Response Team (“IRT”), a multi-disciplinary management committee comprising senior members from the Security Operations Team, legal, finance, internal audit and other functions.
−Removed: The IRT supports the CISO and CIO in supporting and reviewing information security risks and in the event of a cybersecurity incident provides leadership with respect to incident response, investigation, mitigation and remediation.
+Added: Bio-Techne’s cybersecurity program is led by the Company’s Chief Information Officer (“CIO”), with day-to-day management and administration of our cybersecurity program performed by the Director of IT Infrastructure and Security and the IT Security Operations team.
+Added: The Director of IT Infrastrcuture and Security reports to the CIO, and the CIO reports to the Chief Financial Officer.
+Added: The CIO is supported by the Incident Response Team (“IRT”), a multi-disciplinary management committee comprising senior members from the Security Operations Team, legal, finance, internal audit and other functions.
+Added: The IRT supports the CIO in supporting and reviewing information security risks and in the event of a cybersecurity incident provides leadership with respect to incident response, investigation, mitigation and remediation.
In addition to leadership and support within management, we also work with security service providers to monitor for vulnerabilities and threats, and which are reported to the Security Operations team.
−Removed: All employees are trained and tested annually on cybersecurity risks, and we continually perform simulated phishing exercises with a focus on roles and functions with access to sensitive company and financial information.
+Added: All employees are trained and tested annually on cybersecurity risks, and we continually perform simulated phishing exercises.
We also conduct periodic tabletop exercises for key personnel involved in cybersecurity risk management, including the IRT.
5 unchanged sentences
The Audit Committee regularly updates the full Board on these matters.
−Removed: In addition, the CISO and/or CIO provides the full Board with a thorough review of the Company’s cybersecurity program, including current status, industry risks and exposure, and future strategy.
+Added: In addition, on at least an annual basis, the CIO provides the full Board with a thorough review of the Company’s cybersecurity program, including current status, industry risks and exposure, and future strategy.
Based on the information we have as of the date of this Annual Report, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect Bio-Techne, including our business strategy, results of operations or financial condition.
2 unchanged sentences
Cybersecurity Risk Management and Strategy
−Removed: Bio-Techne’s cybersecurity strategy is to maintain and fortify a secure, actively-monitored environment for our and our customers’ data that complies with legal requirements [and industry best practice] while supporting our and our customers’ business needs.
+Added: Bio-Techne’s cybersecurity strategy is to maintain and fortify a secure, actively-monitored environment for our internal and our customers’ data while supporting our and our customers’ business needs.
Our cybersecurity program follows industry standards and best practice for preventing, detecting, remediating, and mitigating potential cybersecurity threats, including regular processes to identify, evaluate and manage potential risks .
5 unchanged sentences
In addition to our evolving processes and systems, we foster a culture of cybersecurity education, training, and testing.
−Removed: Every year, employees in sensitive job categories must take and pass rigorous information security and protection training.
+Added: Every year, employees must take and pass rigorous information security and protection training.
We partner with experienced external consultants to assess our cybersecurity program, and to perform penetration testing as well as other testing programs designed to identify vulnerabilities and areas for fortification.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.