24 unchanged sentences
If a cybersecurity incident is determined to be a potentially material cybersecurity incident, our disclosure controls and procedures define the steps to determine materiality and disclose such a material cybersecurity incident.
+Added: When appropriate, we use external service providers and consultants to assess or monitor the environment or otherwise assist with aspects of our cybersecurity controls and risk assessment process.
Our risk management approach is supplemented by external and internal enterprise risk management audits, which are designed to test the effectiveness of our security controls.
2 unchanged sentences
This program includes pre-engagement diligence, contractual security and notification provisions, and ongoing monitoring, as appropriate.
−Removed: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations, under the headings “ We depend on data centers and other infrastructure operated by third parties, as well as internet availability, and any disruption in these operations could adversely affect our business and operating results ,” “ If we are unable to successfully integrate our applications with a variety of third-party technologies, our business and operating results could be adversely affected ,” and “ If our information technology systems are compromised or unauthorized access to customer or user data is otherwise obtained, our applications may be perceived as not being secure, our operations may be disrupted, our applications may become unavailable, customers and end users may reduce the use of or stop using our applications, and we may incur significant liabilities ” included as part of our risk factor disclosures included in Item 1A of this report, which disclosures are incorporated by reference herein.
+Added: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition, or results of operations, under the headings “ We depend on data centers and other infrastructure operated by third parties, as well as internet availability, and any disruption in these operations could adversely affect our business and operating results ,” “ If we are unable to successfully integrate our applications with a variety of third-party technologies, our business and operating results could be adversely affected ,” and “ If our information technology systems are compromised or unauthorized access to customer or user data is otherwise obtained, our applications may be perceived as not being secure, our operations may be disrupted, our applications may become unavailable, customers and end users may reduce the use of or stop using our applications, and we may incur significant liabilities ” in our “Risk Factors” included in Part I, Item 1A of this report, which disclosures are incorporated by reference herein.
Our Board of Directors is actively involved in overseeing risks from cybersecurity threats.
At least once a year, the Board of Directors discusses our programs and policies related to cybersecurity and risk initiatives and considers them closely both from a risk management perspective and as part of Workday’s business strategy.
−Removed: Additionally, the Board has delegated to our Audit Committee oversight of cybersecurity risks and processes to manage them.
+Added: Additionally, the Board has delegated to its Audit Committee oversight of cybersecurity risks and processes to manage them.
Our Audit Committee is comprised entirely of independent directors who regularly evaluate cybersecurity risks.
The materials presented to our Board and Audit Committee include updates on our data security posture, results from third-party assessments , progress towards predetermined risk-mitigation-related goals, our incident response plan, and certain cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks.
−Removed: The Board and Audit Committee generally receive materials, including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the company’s ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer (“CISO”).
+Added: The Board and Audit Committee generally receive materials, including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks and describing our ability to mitigate those risks, and discuss such matters with our Chief Information Security Officer (“CISO”) .
Material cybersecurity threat risks are also considered during separate Board and committee meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, and other relevant matters .
−Removed: Our CISO leads all aspects of our global cybersecurity program, including the identification, evaluation, and prioritization of security risks, as well as the company’s response to material security incidents.
+Added: Our CISO leads all aspects of our global cybersecurity program.
Our CISO joined Workday in 2010 and has served as our CISO since April 2018.
2 unchanged sentences
Our cybersecurity program is also supported by a cross-functional leadership team that contributes to our information security and privacy programs and practices, as well as identifies and mitigates security and privacy risks.
−Removed: This team includes our CIO, our Chief Privacy Officer, and our Chief Legal Counsel.
−Removed: This team contributes to the development of the company’s cybersecurity strategy and is periodically updated regarding evolving cybersecurity risks and the in-place responsive actions.
+Added: This team includes our CIO and our Chief Legal Counsel.
+Added: This team contributes to the development of our cybersecurity strategy and is periodically updated regarding evolving cybersecurity risks and the in-place responsive actions.
This team is also informed about the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described herein, including the operation of our incident response plan.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.