3 unchanged sentences
Safeguarding our critical networks and the information that platform users share with us is vital to our business.
−Removed: One key way that Uber addresses this need is through its cybersecurity risk management program (“Cybersecurity Program”).
−Removed: Uber’s Chief Information Security Officer (“CISO”) is responsible for the Cybersecurity Program, which is coordinated and primarily executed by the global organization of engineers focused on risk management using the NIST Framework (Identify, Protect, Detect, Respond, and Recover) and activities such as automation, secure development, and advanced analytics and monitoring.
+Added: One key way that Uber addresses this need is through its cybersecurity program, which includes a cybersecurity risk management program.
+Added: Uber’s Chief Information Security Officer (“CISO”) is responsible for the cybersecurity program, which is coordinated and primarily executed by the global organization of engineers focused on risk management using the NIST Framework (Govern, Identify, Protect, Detect, Respond, and Recover) and activities such as automation, secure development, and advanced analytics and monitoring.
The CISO has served in such role since February 2021 and has more than 20+ years of engineering and/or cybersecurity experience, including previously as CISO and Deputy Chief Technology Officer at a Fortune 500 company.
The cybersecurity program is also supported by Uber’s Chief Privacy Officer and Associate General Counsel, Privacy & Cybersecurity (“CPO”), who has served in that role since August 2018.
−Removed: The CPO has three decades of experience as a legal advisor to
−Removed: multinational corporations, including serving as Chief Privacy & Security Counsel for a Fortune 100 technology company prior to her role at Uber.
−Removed: The Cybersecurity Program is supported by other members of Uber’s senior management team as well, including the Chief Legal Officer, Head of Platform Engineering, and EU Data Protection Officer.
+Added: The CPO has over three decades of experience as a legal advisor to multinational corporations, including serving as Chief Privacy & Security Counsel for a Fortune 100 technology company prior to her role at Uber.
+Added: The cybersecurity program is supported by other members of Uber’s senior management team as well, including the Chief Legal Officer, Chief Architect Officer, and Global Data Protection Officer.
Uber’s Board of Directors oversees the cybersecurity program through regular updates.
8 unchanged sentences
• Internally conducted environment and vulnerability assessments.
−Removed: These include semi-annual assessments performed by Uber’s security engineering teams.
+Added: These include regular assessments performed by Uber’s security engineering teams.
The findings from these assessments are reported to Uber’s senior management, including the CISO, and the Board or Audit Committee.
In addition, our internal audit function periodically conducts additional reviews and assessments, which are reported to the Audit Committee.
+Added: We also conduct table-top exercises to simulate the response to cybersecurity incidents;
+Added: participants may include, among others, the CISO, the CPO, and representatives from communications, investor relations, finance and legal.
• Independent third-party audits and assessments by industry-leading firms.
−Removed: These include regular assessments of Uber’s information systems, business systems and cybersecurity infrastructure;
−Removed: reviews to identify opportunities to strengthen Uber’s cybersecurity posture;
−Removed: and cybersecurity audits for purposes of maintaining Uber’s Payment Cards Industry (PCI), ISO 27001 and 27002, and SOC1 and SOC2 certifications.
+Added: As a global organization, Uber undergoes annual audits to maintain its certification as a Payment Card Industry Data Security Standard (PCI DSS 4.0) Level 1 Merchant and Service provider.
+Added: Uber also undergoes annual audits to maintain its ISO 27001 certification for its core mobility, delivery, and enterprise businesses, and SOC 2 attestations that vary depending on the Uber product.
• Cyber incident management.
10 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.