3 unchanged sentences
We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to patients and clinical trials (“Information Systems and Data”).
−Removed: Various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, help identify, assess and manage our cybersecurity threats and risks, with the assistance of a third-party IT managed
−Removed: service provider.
+Added: Various members of our management team, IT department and other employees, including but not limited to the individuals on our cybersecurity incident management team, help identify, assess and manage our cybersecurity threats and risks, with the assistance of a third-party IT managed service provider.
We manage, identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example:
5 unchanged sentences
evaluating our and our industry’s risk profile;
−Removed: conducting tabletop incident response exercises;
+Added: conducting routine tabletop incident response exercises;
and evaluating certain threats reported to us.
+Added: With the help of our managed services provider, we have implemented a Security Operations Center ("SOC") service to provide continuous 24/7 monitoring and incident response across our network infrastructure.
Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example:
incident response plans and procedures, disaster recovery/business continuity plans, risk assessments, implementation of security standards and certifications, encryption of certain data, network security controls on certain networks, data segregation, Wi-Fi segregation, access controls for certain environments, physical security, asset management, tracking and disposal, systems monitoring, vendor risk management program, employee training and penetration testing.
−Removed: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes.
−Removed: For example, cybersecurity risk is addressed as a component of our enterprise risk management program, and members of our management team, IT department and other relevant team members work together to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business, and report regularly to our board of directors on cybersecurity matters.
−Removed: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, threat intelligence service providers, dark web monitoring services, and other cybersecurity software providers.
+Added: Our assessment and management of cybersecurity risks are integrated into our enterprise risk management program.
+Added: Cybersecurity risk is addressed as part of our overall risk governance framework, and members of our management team, IT department and other relevant functional teams collaborate to prioritize risk mitigation efforts, address threats that may have a material impact on our business, and report regularly to our board of directors on cybersecurity matters.
+Added: We engage third-party service providers to assist us to identify, assess, and manage material risks from cybersecurity threats, including for example managed cybersecurity service providers, threat intelligence service providers, dark web monitoring services, and other cybersecurity software providers.
We use third-party service providers to perform a variety of functions throughout our business, including but not limited to application providers, hosting companies, contract manufacturing organizations and contract research organizations.
19 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.