4 unchanged sentences
Our approach involves an annual review of our established IT systems and vendor relationships, to assess salient risks and discuss mitigation procedures, as well as the establishment of an Incident Response Team appointed to manage cybersecurity risk, which meets at least twice per year.
−Removed: The Incident Response Team is led by the Company’s Systems Administrator and Cybersecurity Analyst, and includes employees from different functions and levels of the organization, including the Head of Engineering (most senior IT leader), the General Counsel and Head of Global Functions (executive-level legal), the Global Head of Business Services (most senior business operations leader), as well as representatives from finance, marketing, and customer service.
+Added: The Incident Response Team is led by the Company’s Systems Administrator and Cybersecurity Analyst , and includes employees from different functions and levels of the organization, including the Head of Engineering (most senior IT leader), the Chief Membership Officer and General Counsel (executive-level legal), the Global Head of Business Services (most senior business operations leader), as well as representatives from finance, marketing, and customer service.
The team is also supported by external vendors and consultants, as needed (for example, specialized cybersecurity legal counsel, specialized IT cybersecurity agencies and Sarbanes-Oxley (SOX) compliance/audit consultants to assist with internal controls review).
+Added: We also carry cyber liability insurance to compensate us for losses that may occur as a result of certain cybersecurity incidents.
The Incident Response Team follows industry best-practices for Payment card industry (PCI) compliance and cybersecurity.
15 unchanged sentences
Although we expend significant internal resources to protect against security breaches, our existing security measures may not be successful in preventing all attacks on our systems.
−Removed: We have experienced cybersecurity incidents and threats, including malware, phishing, partner and customer account takeover attacks, and denial-of-service attacks on our systems.
+Added: We have historically experienced cybersecurity incidents and threats, including malware, phishing, partner and customer account takeover attacks, and denial-of-service attacks on our systems.
We do not believe these cybersecurity incidents have had a materially adverse effect on our Company, including our business strategy, results of operations, or financial condition.
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.