4 unchanged sentences
We recognize the importance of developing, implementing and maintaining cybersecurity measures that are designed to maintain the security, confidentiality, integrity and availability of our business systems and confidential information, including personal information and intellectual property.
−Removed: Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity in an effort to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to inform management and our Board of Directors of any significant cybersecurity risks and developments.
−Removed: Our Senior Director of Operations (“DO”) , with assistance from our third-party information technology (“IT”) support firm, leads the Company’s effort in establishing cybersecurity strategies and structures that help to identify, assess, and manage the Company’s cybersecurity threats and risk.
−Removed: Our DO working knowledge of end-user best practices and regularly meets with our third-party IT support firm to discuss potential cybersecurity threats and risk.
−Removed: This team helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and
−Removed: tools, for example, phishing and social engineering tests.
−Removed: Based on these meetings, our DO identifies additional end-user education and company security needs, which are supported through our IT support firm or other third-party IT experts.
+Added: Our cybersecurity risk management program leverages a combination of processes, technologies and personnel with expertise in cybersecurity in an effort to comply with applicable regulations and detect and respond to cyber-attacks, data breaches, security incidents, and compromises of personal information, as well as to inform management and our Board of Directors (the "Board") of any significant cybersecurity risks and developments.
+Added: Our Vice President of Operations (“VPO”) , with assistance from our third-party information technology (“IT”) support firm, leads the Company’s effort in establishing cybersecurity strategies and structures that help to identify, assess and manage the Company’s cybersecurity threats and risk.
+Added: Our VPO has working knowledge of end-user best practices and regularly meets with our third-party IT support firm to discuss potential cybersecurity threats and risk.
+Added: This team helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods and tools, for example, phishing and social engineering tests.
+Added: Based on these meetings, our VPO identifies additional end-user education and company security needs, which are supported through our IT support firm or other third-party IT experts.
We have worked, and expect to continue to work, with third-party service providers, as appropriate, to assess, identify and manage cybersecurity risks.
−Removed: As such, our DO meets with the senior management from our IT support firm regularly to discuss work requests and issues raised that may need to be added to the network for security.
+Added: As such, our VPO meets with the senior management from our IT support firm regularly to discuss work requests and issues raised that may need to be added to the network for security.
We also conduct periodic and on-demand assessments of our cybersecurity risk management program with expert service providers to ensure it remains current, given the changing risk environment.
−Removed: The DO regularly updates cybersecurity matters to the executive management team.
+Added: The VPO regularly updates cybersecurity matters to the executive management team.
We use third-party service providers to perform a variety of critical functions throughout our business, such as hosting providers, application providers, contract research organizations and contract manufacturing organizations.
1 unchanged sentence
Depending on the nature of the services provided, the sensitivity of the information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.
−Removed: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our DO.
−Removed: Our DO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, communicating key priorities to relevant employees and personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.
+Added: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our VPO.
+Added: Our VPO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company’s overall risk management strategy, communicating key priorities to relevant employees and personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes and reviewing security assessments and other security-related reports.
Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances.
−Removed: Our DO, with the appropriate members of management, will work with the Company’s incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified.
+Added: Our VPO, with the appropriate members of management, will work with the Company’s incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified.
In addition, the Company’s incident response plan includes reporting to the Audit Committee of the Board of Directors ("Audit Committee") for certain cybersecurity incidents.
Cybersecurity risks are overseen by the Audit Committee.
−Removed: The Audit Committee is central to the Board of Directors’ oversight of cybersecurity risks and bears the primary responsibility for overseeing cybersecurity risk.
+Added: The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for overseeing cybersecurity risk.
The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major cybersecurity initiatives.
This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.
−Removed: Our DO provides comprehensive updates to the Audit Committee and the full Board of Directors at least annually.
+Added: Our VPO provides comprehensive updates to the Audit Committee and the full Board of Directors at least annually.
These briefings have included a range of topics, such as:
4 unchanged sentences
• Regulatory changes impacting cybersecurity requirements and strategy.
−Removed: The Board of Directors is aware of the importance of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.
+Added: The Board is aware of the importance of managing risks associated with cybersecurity threats and is actively engaged in our cybersecurity risk management strategy.
As of the date of this report, there have been no cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, operations, or financial condition.
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.