3 unchanged sentences
We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to patients and clinical trials (“Information Systems and Data”).
−Removed: Various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, help identify, assess and manage our cybersecurity threats and risks.
+Added: Various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, help identify, assess and manage our cybersecurity threats and risks, with the assistance of a third-party IT managed
+Added: service provider.
We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example:
−Removed: through the use of automated tools, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention (including through the use of machine learning, a form of artificial intelligence), patch management, distributed denial of service (DDoS) protection and forensics;
+Added: through the use of automated tools in certain environments, including but not limited to tools for monitoring, geolocation, remote wiping, threat detection, intrusion detection and prevention (including through the use of machine learning, a form of artificial intelligence), patch management, distributed denial of service (DDoS) protection and forensics;
conducting (directly or through third parties) regular audits and threat assessments for internal and external threats;
subscribing to reports and services that identify cybersecurity threats;
−Removed: analyzing reports of threats and actors;
−Removed: conducting vulnerability assessments to identify vulnerabilities;
+Added: analyzing reports of certain threats and actors;
+Added: conducting vulnerability assessments in certain environments to identify vulnerabilities;
evaluating our and our industry’s risk profile;
conducting tabletop incident response exercises;
−Removed: and evaluating threats reported to us.
+Added: and evaluating certain threats reported to us.
Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example:
−Removed: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.
+Added: incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of certain data, network security controls on certain networks, data segregation, Wi-Fi segregation, access controls for certain environments, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.
Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes.
2 unchanged sentences
We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers, hosting companies, contract manufacturing organizations and contract research organizations.
−Removed: We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of these providers.
+Added: We have a vendor management program to oversee, identify and manage cybersecurity risks associated with our use of certain of these providers.
The program includes a risk assessment for vendors that may include, depending on the vendor and nature of services being performed, security questionnaires, review of the vendor's written security program, review of security assessments, audits and reports, vulnerability scans related to the vendor, security assessment calls with the vendor's security personnel, and the imposition of certain contractual obligations on the vendor, among other elements, in accordance with the processes outlined in our internal vendor selection, management, and oversight process policy and other internal guidelines.
−Removed: More specifically, the level of assessment may depend on the following:
−Removed: the nature of the services provided and the data the vendors may collect, retain, and utilize, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.
+Added: More specifically, the level of assessment may depend on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider.
For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1.
5 unchanged sentences
loss of sales and other adverse consequences.”
−Removed: Our board of directors addresses our cybersecurity risk management as part of its general oversight function.
+Added: Our Nominating / Corporate Governance Committee has oversight of our cybersecurity risk management program and reports to our board of directors on cybersecurity matters.
Our cybersecurity risk assessment and management processes are implemented and maintained by various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, which includes individuals who have a diverse combination of relevant expertise, experience, education and training, with representation from our IT, legal, human resources, compliance, risk and privacy functions, among others.
4 unchanged sentences
Our cybersecurity incident management team, and other individuals as needed, work to help us mitigate and remediate cybersecurity incidents of which we are notified.
−Removed: In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors.
−Removed: The board of directors receives regular reports from management concerning our cybersecurity risk management program.
−Removed: The board also receives various summaries and/or presentations related to cybersecurity threats, risks and mitigation.
−Removed: Commencing in 2024, our Nominating / Corporate Governance Committee is taking the lead on behalf of the board of directors on oversight of our cybersecurity risk management program.
+Added: In addition, our incident response processes include a procedure for reporting certain cybersecurity incidents to the board of directors and/or the Nominating / Corporate Governance Committee.
+Added: The Nominating / Corporate Governance Committee receives regular reports from management concerning our cybersecurity risk management program , and also receives various summaries and/or presentations related to cybersecurity threats, risks and mitigation.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.