1 unchanged sentence
Cybersecurity
−Removed: Our board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees.
−Removed: Our board of directors is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management (“ERM”).
+Added: Our board of directors is actively involved in oversight of cybersecurity, recognizing the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees.
Risk Management and Strategy
−Removed: We have policies, standards, processes and practices for assessing, identifying, and managing material risk from cybersecurity threats that are integrated into our ERM systems and processes .
−Removed: Our cross-functional approach to cybersecurity risk management is focused on preserving the confidentiality, integrity, and availability of our information systems by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
+Added: We have policies, standards, processes and practices for assessing, identifying, and managing risk from cybersecurity threats that are integrated into our risk management systems and processes .
+Added: Utilizing a cross-functional approach, we focus on preserving the confidentiality, integrity, and availability of our information systems by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
As part of this approach, we have implemented controls and procedures that provide for the prompt escalation of certain cybersecurity incidents to enable timely decisions by management regarding the public disclosure and reporting of such incidents.
1 unchanged sentence
• Governance.
−Removed: As discussed in more detail under the heading “Governance” below, our board of directors’ oversight of cybersecurity risk is supported by our audit committee, which regularly interacts with our ERM function, our Chief Digital Officer (“CDO”), our Chief Information Security Officer (“CISO”), other members of management, and relevant committees and working groups, including management’s Enterprise Risk Committee (“ERC”), Cyber Incident Task Force (“CITF”), and Security Incident Response Team (“SIRT”), in its oversight of cybersecurity-related risk.
+Added: As discussed in more detail under the heading “Governance” below, our board of directors oversees cybersecurity risk through regular interactions with our Chief Information Security Officer (“CISO”) and other members of management.
+Added: In addition, our board of directors, supported by our audit committee, oversees the risk management systems and processes into which cybersecurity risk is integrated.
• Risk Assessment.
−Removed: We devote significant resources and designate high-level personnel, including our ERC, which includes our CDO, our CISO, our Chief Legal Officer (“CLO”), our Vice President of Internal Audit, and our Vice President of Ethics, Compliance and Risk Management, to manage the cybersecurity risk assessment and mitigation process.
−Removed: We conduct security assessments both internally and with the assistance of third parties to identify cybersecurity threats periodically and to
−Removed: identify any potentially material changes in our business practices that may affect information systems that are vulnerable to such cybersecurity threats.
+Added: We conduct security assessments both internally and with the assistance of third parties to identify cybersecurity threats periodically and to identify any potentially material changes in our business practices that may affect information systems that are vulnerable to such cybersecurity threats.
These security assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential impact of such risks, and the sufficiency and effectiveness of existing policies, procedures, systems, and controls to manage such risks.
3 unchanged sentences
We align our security program to recognized frameworks and industry standards.
−Removed: We make investments in core security capabilities, including awareness and training, identity and access, incident response, product security, cloud security, enterprise security, risk management, and supply chain risk, in order to enable us to better identify, protect, detect, respond to, and recover from evolving security threats.
+Added: We make investments in core security capabilities, including awareness and training, identity and access, incident response, product security, cloud security, enterprise security, and risk management, in order to
+Added: enable us to better identify, protect, detect, respond to, and recover from evolving security threats.
Our technical safeguards include firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through internal and external security assessments and cybersecurity threat intelligence.
6 unchanged sentences
• Third-Party Risk Management.
−Removed: We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
−Removed: We perform due diligence on vendors, service providers and other third-party users of our systems at initial onboarding and periodically thereafter.
−Removed: We require that third-party service providers have the ability to implement and maintain reasonable and appropriate security measures, consistent with applicable laws, in connection with their work with us, and to promptly report any actual or suspected breach of their security measures that may affect our company.
+Added: We identify and oversee cybersecurity risks presented by third parties and our supply chain, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.
+Added: As part of our risk-based approach, we perform due diligence on vendors, service providers and other third-party users of our systems at initial onboarding and periodically thereafter.
+Added: We also require that third-party service providers have the ability to implement and maintain reasonable and appropriate security measures, consistent with applicable laws, in connection with their work with us, and to promptly report any actual or suspected breach of their security measures that may affect our company.
• Security Awareness and Training.
3 unchanged sentences
In addition, we conduct awareness campaigns on cybersecurity threats as a means to equip our personnel with effective tools to address such threats and to communicate our evolving information security policies, standards, processes and practices.
−Removed: We engage in the periodic assessment and testing of our cybersecurity policies, standards, processes and practices, including through audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.
−Removed: To assist with such assessment and testing, we engage assessors, consultants, auditors, and other third parties to perform assessments on our cybersecurity measures, including for third-party testing and certifications (as described above under “Technical Safeguards”), information security maturity assessments, customer audits, and independent reviews of our information security control environment and operating effectiveness.
−Removed: The material results of such assessments, audits and reviews are reported to our audit committee, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided.
+Added: We engage in the periodic assessment and testing of our cybersecurity policies, standards, processes and practices, including through audits, assessments, tabletop exercises, threat modeling, vulnerability testing, and other exercises focused on evaluating their effectiveness and informing adjustments as necessary.
+Added: To assist with these exercises, we engage assessors, consultants, auditors, and other third parties, including for third-party testing and certifications (as described above under “Technical Safeguards”), information security maturity assessments, customer audits, and independent reviews of our information security control environment and operating effectiveness.
To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our company, including our business strategy, results of operations, or financial condition.
For additional information regarding whether any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, are reasonably likely to materially affect our company in the future, including our business strategy, results of operations, or financial condition, see Part I, Item 1A, “Risk Factors” in this Annual Report on Form 10-K.
−Removed: Our board of directors, in coordination with our audit committee, oversees our ERM process, including the management of cybersecurity risks, and is responsible for monitoring and assessing strategic risk exposure.
−Removed: Our management team and its committees, including our ERC, our CITF, our SIRT , and our core information security operational teams, in partnership with our engineering teams, are responsible for the day-to-day management and mitigation of the material cybersecurity risks we face.
−Removed: Our board of directors administers its cybersecurity risk oversight function as a whole, as well as through our audit committee.
−Removed: Our audit committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties, and risks relating to cybersecurity incidents.
−Removed: Our board of directors has previously received quarterly updates from our audit committee on ERM and cybersecurity risks after the audit committee is updated by management but, as a reflection of the importance we place on managing and overseeing cybersecurity risk, management expects to provide quarterly updates directly to the board of directors beginning in 2025.
−Removed: Our ERC, comprised of our CLO, our CDO, our CISO, our Vice President of Internal Audit, and our Vice President of Ethics, Compliance and Risk Management, among others, oversees our ERM activities, including cybersecurity-related risks.
−Removed: Our CDO and our CISO (who reports to our CDO) are primarily responsible for the assessment and management of our material risks from cybersecurity threats, working collaboratively and cross-functionally to design and implement our cybersecurity policies and processes, including those described in “Risk Management and Strategy” above, and for responding to any cybersecurity incidents.
−Removed: In addition, our CITF (which includes our CDO, our CISO, our CLO, and our Chief Financial Officer (“CFO”)) is primarily responsible for evaluating cybersecurity incidents, gathering and assessing facts relevant to applicable regulatory reporting and disclosure obligations, making recommendations to our Chief Executive Officer and CFO regarding such disclosure, and advising our board of directors and audit committee on the effectiveness of policies and procedures related to the disclosure of cybersecurity incidents.
+Added: Our board of directors, in coordination with our audit committee, oversees the management of cybersecurity risks, and is responsible for monitoring and assessing strategic risk exposure through our risk management processes.
+Added: Our management team is responsible for the day-to-day management and mitigation of the material cybersecurity risks we face.
+Added: This is carried out under the leadership of our CISO, and involves our Security Incident Response Team (“SIRT”) and other core information security operational teams, in partnership with our engineering teams, as well as management committees, including our Cyber Incident Task Force (“CITF”).
+Added: During 2025, our board of directors received quarterly updates directly from management on cybersecurity risks.
+Added: Management’s presentations on cybersecurity risks address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties, and risks relating to cybersecurity incidents.
+Added: Our CISO is primarily responsible for the assessment and management of our material risks from cybersecurity threats, working collaboratively and cross-functionally to design and implement our cybersecurity policies and processes, including those described in “Risk Management and Strategy” above, and for responding to any cybersecurity incidents.
+Added: Our SIRT is primarily responsible for detecting, mitigating and remediating cybersecurity threats and incidents.
+Added: In addition, our CITF (which includes our CISO and our Chief Financial Officer (“CFO”)) is primarily responsible for evaluating cybersecurity incidents, gathering and assessing facts relevant to applicable regulatory reporting and disclosure obligations, making
+Added: recommendations to our Chief Executive Officer and CFO regarding such disclosure, and advising our board of directors and audit committee on the effectiveness of policies and procedures related to the disclosure of cybersecurity incidents.
To facilitate our cybersecurity risk management program, multidisciplinary teams throughout our company are deployed to address cybersecurity threats and to respond to cybersecurity incidents.
−Removed: Through ongoing communications with these teams, our CDO, our CISO, and the SIRT monitor the detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the CITF when appropriate.
−Removed: Our CDO has over 25 years of experience at technology companies and has been in the security space for over 18 years, including serving as c hief security officer at a public company and leading security engineering at another public company.
−Removed: Our CDO also serves on the board of directors of a publicly traded cybersecurity company.
−Removed: Our CDO holds an undergraduate degree in electronics engineering and a graduate degree in business administration and management.
−Removed: Our CISO has over 18 years of experience managing cybersecurity risks in the technology industry, including serving as the acting chief security officer at a public company and holding other senior cybersecurity leadership and operational roles at other companies.
+Added: Through ongoing communications with these teams, our CISO, and the SIRT monitor the detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the CITF when appropriate.
+Added: Our management team responsible for assessing and managing cybersecurity risks includes experienced professionals, with many years of relevant experience managing cybersecurity and other risks at the Company and at similar companies, and broad technological expertise.
+Added: In particular, our CISO has over 20 years of experience managing cybersecurity risks in the technology industry, including serving as the acting chief security officer at a public company and holding other senior cybersecurity leadership and operational roles at other companies.
Our CISO holds an undergraduate degree in computer engineering and graduate degrees in electrical engineering and business administration.
−Removed: Our CFO, VP of Internal Audit, and VP of Ethics, Compliance and Risk Management each hold undergraduate and/or graduate degrees in their respective fields, and have over 10 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.
−Removed: If one of the roles described in this Item 1C is vacant, another senior member of the applicable functional team is selected to serve on our ERC, CITF, or any other applicable committees or task forces on an interim basis, as needed.
+Added: If one of the roles described in this Item 1C is vacant, another senior member of the applicable functional team is selected to serve on our CITF or any other applicable committees or task forces on an interim basis, as needed.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.