7 unchanged sentences
This includes a strong focus on aligning employee education programs to ensure a seamless transition and uphold security and privacy standards across our entities.
−Removed: Our cybersecurity strategy is based on a multi-layered defense framework, aligned with the U.S.
−Removed: National Institute of Standards and Technology ("NIST") guidelines.
We take a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect our operations, finances, legal or regulatory compliance, or reputation.
3 unchanged sentences
We conduct regular trainings and simulations to enhance our team's awareness and preparedness against cyber threats.
−Removed: Annual penetration testing and regular assessments by external experts validate the effectiveness of our cybersecurity measures.
Our proactive approach to addressing identified vulnerabilities affirms the continuous improvement of our security posture.
−Removed: To further strengthen our cybersecurity risk management framework, we have instituted an Information Security Management System (“ISMS”) that equips us with advanced risk management capabilities.
−Removed: This system facilitates the development of a detailed risk registry, incorporating impact and likelihood scoring to prioritize risks effectively.
−Removed: Additionally, it guides the creation of comprehensive risk treatment plans and sets targets for residual risk, ensuring a strategic approach to risk mitigation.
−Removed: A key feature of our ISMS is a risk management insights dashboard, which provides real-time visibility into the current state of risk within our environment.
−Removed: This dashboard is an invaluable tool for our management and key stakeholders, enabling them to track risk exposure and trends accurately.
−Removed: Quarterly reviews are scheduled, during which key stakeholders convene to scrutinize and adjust risk treatment plans in response to the latest threat landscape.
−Removed: This process underscores our commitment to a dynamic and responsive cybersecurity risk management strategy, ensuring the ongoing protection of our systems, data, and operations against emerging threats.
Use of Consultants and Advisors.
7 unchanged sentences
These risk determinations are crucial in driving the level of due diligence and ongoing compliance monitoring required for each service provider.
−Removed: Enhancing our third-party vendor risk management, we have introduced two distinct capabilities to further safeguard our operations and sensitive data:
−Removed: We leverage a threat intelligence platform watchlist to curate, monitor, alert, and provide a risk rating to third-party vendors.
−Removed: This platform also offers a dashboard and real-time reporting, enabling us to stay ahead of potential threats by providing continuous oversight and actionable intelligence.
−Removed: Our ISMS platform encompasses vendor risk management capabilities, facilitating initial due diligence through the collection of vendor security-related artifacts.
−Removed: It applies risk ratings and delivers and analyzes annual security questionnaires, scheduling reviews and tasks to ensure compliance and security standards are met consistently.
−Removed: Additionally, our virtual Chief Information Security Officer ("vCISO") compiles a quarterly executive summary of third-party risk, which is presented to both management and the Board.
−Removed: This summary ensures that leadership is informed of the current risk landscape and can make data-driven decisions regarding third-party engagements.
Board Oversight and Management ’ s Role.
2 unchanged sentences
Management has implemented robust risk management structures, policies, and procedures, with day-to-day cybersecurity risk management being a core responsibility.
−Removed: Our Chief Financial Officer ("CFO") spearheads the assessment and management of cybersecurity risks on a daily basis, ensuring that our strategies and actions are both proactive and responsive to the evolving cybersecurity landscape.
+Added: Our Chief Information Officer ("CIO") spearheads the assessment and management of cybersecurity risks, ensuring that our strategies and actions are both proactive and responsive to the evolving cybersecurity landscape .
Supporting this effort, we have a cross-departmental approach to cyber security management.
2 unchanged sentences
The content of these updates includes progress on ongoing cybersecurity initiatives, insights from recent threat assessments or incidents, findings and action plans derived from external vulnerability and penetration tests, and key performance metrics aligned with industry standards.
+Added: Our CIO and our Chief Financial Officer report risks to the Audit Committee on a quarterly basis.
Risks from Material Cybersecurity Threats.
5 unchanged sentences
Furthermore, we have established Incident Response as a Service ("IRaaS") to ensure rapid and effective action in the event of a security breach.
−Removed: To maintain a strategic overview of our cybersecurity landscape, we conduct quarterly strategic reporting sessions.
−Removed: These sessions are crucial for reviewing security activity and identifying areas for improvement.
−Removed: Based on these reviews, we develop a Plan of Action and Milestones ("POAM") for remediation or re-architecture as necessary.
−Removed: Although these risks have not yet materially impacted our business, we remain vigilant, continuously monitoring and adapting to evolving cybersecurity threats.
−Removed: Our commitment to cybersecurity is integral to our risk management strategy, ensuring the ongoing protection of our systems and the sensitive data they contain.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.