5 unchanged sentences
As part of our program:
−Removed: we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology (NIST) cybersecurity framework and the International Organization for Standardization (ISO);
+Added: we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology cybersecurity framework and the International Organization for Standardization ("ISO");
we maintain a dedicated cybersecurity team under the direction of our Chief Technology Officer ("CTO") and supported by our Chief Information Security Officer ("CISO"), each of whom has expertise related to data and network security, data governance and risk management;
2 unchanged sentences
we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our information systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf;
−Removed: we conduct pre-engagement and recurring reviews of the security controls and security-compliance posture of applicable third-party service providers;
+Added: we conduct pre-engagement and targeted recurring reviews of the security controls and security-compliance posture of applicable third-party service providers;
all employees are required to complete periodic trainings that cover security and privacy best practices and company policies;
−Removed: we have prepared and regularly review and test our business continuity, disaster recovery and other back-up plans, including as they relate to cybersecurity incidents;
+Added: we regularly review our business continuity and other back-up plans, including as they relate to cybersecurity incidents;
we perform periodic simulations of attack scenarios by an internal “Red Team” to test the efficacy of both security controls and our tactical incident response procedures.
5 unchanged sentences
if deemed appropriate, reporting by our CISO to the Company’s Management and its Disclosure Committee, comprised of multi-disciplinary senior leaders across the organization, including representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required;
−Removed: informing the Audit Committee of our Board of Directors (the “Board”) of significant or material cybersecurity incidents, as appropriate.
+Added: informing the Audit Committee of our Board of significant or material cybersecurity incidents, as appropriate.
All incidents are documented and recorded and catalogued for further review by the CISO and their team.
6 unchanged sentences
2K Games immediately notified all affected users and took steps to restrict further unauthorized activity until service was restored.
−Removed: In connection with this activity , we have incurred certain immaterial incremental one-time costs related to
−Removed: consultants, experts and data recovery efforts and we generally expect to incur additional costs related to cybersecurity protections in the future.
+Added: In connection with this activity, we have incurred certain immaterial incremental one-time costs related to consultants, experts and data recovery efforts and we generally expect to incur additional costs related to cybersecurity protections in the future.
In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, reputational harm, and loss of investor confidence.
2 unchanged sentences
As part of its oversight function, the Board, directly and through its Audit Committee, oversees the Company’s risk assessment and risk management policies, including related to cybersecurity.
−Removed: At least semi-annually (with respect to the Audit Committee) and annually (with respect to the Board), our CTO and CISO report to the Audit Committee or the Board addressing a broad range of topics, including significant cybersecurity incidents that have occurred, if any, since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.
+Added: At least quarterly (with respect to the Audit Committee) and annually (with respect to the Board), our CTO and CISO report to the Audit Committee or the Board, respectively, addressing a broad range of topics, including significant cybersecurity incidents that have occurred, if any, since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.
Our senior management is responsible for assessing and managing the Company’s various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through an enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks.
2 unchanged sentences
Our internal audit team is responsible for testing and auditing our information-technology internal controls.
−Removed: In addition, leaders from our communications, finance, legal and risk teams participate in incident response training, including tabletop exercises, designed to enhance our ability to respond to cybersecurity incidents quickly, efficiently and with the appropriate degree of urgency.
+Added: In addition, leaders from our communications, finance, legal
+Added: and risk teams participate in incident response training, including tabletop exercises, designed to enhance our ability to respond to cybersecurity incidents quickly, efficiently and with the appropriate degree of urgency.
We believe our information technology team to be well-qualified in this area.
−Removed: These qualifications include collective decades of professional experience in the field, in both private enterprise and government, and relevant training and certifications, such as Certified Information Systems Security Professional (CISSP) certification, ISO 27001 certification, and other technical cybersecurity certifications from ISC2, the SANs Institute and OffSec as well as recent participation in IT and cybersecurity programs organized by leading educational institutions with expertise in the field.
+Added: These qualifications include collective decades of professional experience in the field, in both private enterprise and government, and relevant training and certifications, such as Certified Information Systems Security Professional certification, ISO 27001 certification, and other technical cybersecurity certifications from ISC2, the SANs Institute and OffSec as well as recent participation in IT and cybersecurity programs organized by leading educational institutions with expertise in the field.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.