1 unchanged sentence
Cybersecurity
−Removed: As part of its oversight of our company, our board of directors is involved in overseeing our risk management program.
−Removed: Cybersecurity is an important component of overall enterprise risk management (“ERM”).
−Removed: Our cybersecurity processes are fully integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and industry standards and regulations, including the NYDFS Cybersecurity Regulation and PCI DSS.
−Removed: We address cybersecurity risks through an approach that focuses on preserving the confidentiality, integrity, and availability of our assets, including the information we collect and store, by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents as they occur.
+Added: Our Board of Directors oversees our enterprise risk management ("ERM") program, and cybersecurity is a core component of that oversight.
+Added: Our cybersecurity practices are fully integrated into our ERM framework and follow recognized standards, including those developed by NIST, ISO, and applicable industry regulations such as the NYDFS Cybersecurity Regulation and PCI DSS.
+Added: Our approach focuses on protecting the confidentiality, integrity, and availability of our systems and data by identifying, preventing, mitigating, and responding to cybersecurity threats and incidents.
Risk Management and Strategy
−Removed: Our cybersecurity risk management program focuses on the following key areas:
+Added: Our cybersecurity risk management program focuses on the following areas:
• Technical Safeguards.
−Removed: We utilize technical safeguards that are designed to protect our assets from cybersecurity threats.
−Removed: These safeguards include firewalls, intrusion prevention and detection systems, Managed Detection and Response, antimalware and access controls solutions, which we evaluate and improve through security assessments and threat intelligence.
−Removed: • Incident Response and Recovery Planning.
−Removed: We have established and maintained incident response and recovery plans that address how we respond to cybersecurity incidents, and we test and evaluate these plans on a regular basis.
+Added: We implement multiple layers of technical controls—including firewalls, intrusion detection and prevention systems, Managed Detection and Response (MDR), anti-malware tools, and access-control systems.
+Added: We continuously evaluate and improve these safeguards through security assessments and threat intelligence.
+Added: • Incident Response and Recovery.
+Added: We maintain formal incident response and recovery plans that outline our approach to cybersecurity events.
+Added: These plans are regularly tested and refined to ensure their effectiveness.
• Third-Party Risk Management.
−Removed: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including software and services vendors, Territory Partners and other external users of our systems and those of third parties that could adversely impact our business in the event of a cybersecurity incident.
−Removed: We provide regular, mandatory training for all team members regarding general security concepts, cybersecurity, and physical threats.
−Removed: The training is designed to equip team members to identify and properly respond to a variety of cybersecurity threats and risks, as well as to communicate our processes.
+Added: We apply a risk-based approach to evaluating and managing cybersecurity risks arising from third parties, including vendors, service providers, Territory Partners, and other external users whose systems or actions could affect our operations.
+Added: All team members complete regular, mandatory training on security fundamentals, cybersecurity threats, physical security risks, and appropriate response practices.
• Governance.
−Removed: We maintain a management Risk Committee that assists with our ERM function.
−Removed: We also utilize a virtual Chief Information Security Officer (“vCISO”) and other members of senior management and our IT team to support our risk management program.
−Removed: Our board of directors receives regular reports regarding our ERM function to support its oversight responsibilities, and we ensure our business units receive appropriate updates that may impact operations.
+Added: Our management Risk Committee supports the ERM program and provides regular updates to the Board of Directors.
+Added: The Chief Information Security Officer ("CISO"), who reports to the Chief Information Officer ("CIO"), leads our cybersecurity program and provides frequent briefings to the CEO, executive leadership, and the Board’s Audit Committee.
• Collaboration.
−Removed: Our processes are designed to identify, prevent, and mitigate cybersecurity threats and incidents and provide for prompt escalation when appropriate.
−Removed: This approach is cross-functional, drawing on the skills and experiences of our diverse team, and it is designed to allow management to make timely decisions regarding public disclosure and business matters.
−Removed: We periodically assess and test our cybersecurity processes.
−Removed: These efforts include a wide range of activities, such as audits, assessments, tabletop exercises, threat modeling and vulnerability testing focused on evaluating the effectiveness of our cybersecurity measures and planning.
−Removed: We regularly engage independent third parties to assess our cybersecurity measures, including audits and reviews of our information security control environment and operating effectiveness.
−Removed: The results of such assessments are reported to management's Risk Committee and to our board of directors.
−Removed: We adjust our cybersecurity documentation, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.
−Removed: Our board of directors, in coordination with our internal Risk Committee, oversees our ERM function, including the management of risks arising from cybersecurity threats.
−Removed: Our board of directors receives regular updates on cybersecurity matters from management's Risk Committee and from the Information Security Committee, which is comprised of Information Technology and Security leadership and oversees operational aspects of our cybersecurity program.
−Removed: Those updates to our board of directors address a wide range of topics that may include information on recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, and information security considerations with respect to our partners and third parties.
−Removed: Our board of directors and management's Risk Committee also receive prompt information regarding any cybersecurity incident that meets established reporting thresholds and ongoing updates on any such incident until it has been addressed.
−Removed: Our Information Security Committee and vCISO annually report on the status of our cybersecurity program and meet with our board of directors to discuss our approach to cybersecurity and risk management.
−Removed: Our Information Security Committee and vCISO, in coordination with management's Risk Committee, work collaboratively to implement a program designed to protect our assets from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans.
−Removed: To facilitate the success of our cybersecurity risk management program, we deploy multidisciplinary teams to address cybersecurity threats and to respond to cybersecurity incidents.
−Removed: Through ongoing communications with these teams, our Information Security Committee monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real-time and report such threats and incidents to management's Risk Committee when appropriate.
−Removed: Our vCISO has served in various information technology, security, and privacy roles for over 25 years, including as the Chief Information Security Officer for several large public companies.
−Removed: Our vCISO holds undergraduate and graduate degrees in business administration and law, including specialties in information systems management and legal risk and compliance.
−Removed: Additionally, he has attained professional certifications in information security, auditing and assessment, and threat intelligence.
−Removed: Cybersecurity threats, including those related to previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect us, our business strategy, operations, or financial condition.
+Added: Our cybersecurity processes are designed to identify, prevent, escalate, and mitigate threats through cross-functional coordination.
+Added: This structure allows management to make timely decisions about business impacts and disclosures when necessary.
+Added: We routinely evaluate the effectiveness of our cybersecurity measures through audits, assessments, tabletop exercises, threat modeling, and vulnerability testing.
+Added: Independent third parties also conduct audits and reviews of our control environment and operating effectiveness.
+Added: Results are shared with the management Risk Committee and the Board, and we update our documentation, processes, and controls based on these findings.
+Added: The Board of Directors, in collaboration with the management Risk Committee, oversees cybersecurity risk within the broader ERM program.
+Added: The Board receives regular updates from the Risk Committee and the CISO on topics such as emerging threats, standards, vulnerability assessments, third-party evaluations, and overall program status.
+Added: Any cybersecurity incident meeting established reporting thresholds is promptly escalated to the Board and monitored until resolved.
+Added: The Audit Committee of the Board of Directors, in collaboration with management, reviews our major financial and cyber risk exposures and the steps management has taken to monitor such exposures, including our procedures and any related policies, with respect to risk assessment and risk management.
+Added: Our Information Security team, led by the CISO and supported by the management Risk Committee, executes our cybersecurity program and coordinates incident response and recovery activities.
+Added: Multidisciplinary teams monitor prevention, detection, mitigation, and remediation efforts in real time and escalate issues to the Risk Committee as needed.
+Added: During the period covered by this report, cybersecurity threats, including those related to past incidents, have not materially affected our business strategy, operations, or financial condition, and as of the date of this report we do not believe such threats are reasonably likely to have a material impact in the future.
+Added: For a discussion of the risks we face relating to cybersecurity threats, please see "Risk Factors."
Our principal executive offices are located at 6100 4th Avenue South, Seattle, Washington.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.