3 unchanged sentences
We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our overall information technology, or IT, function.
−Removed: These processes are designed to help protect our operations and information assets from unauthorized access or attack, as well as secure our networks and information systems.
+Added: These processes are designed to help protect our operations and information assets
+Added: from unauthorized access or attack, as well as secure our networks and information systems.
Such processes include technical, procedural, and organizational safeguards, including, without limitation:
16 unchanged sentences
Management is responsible for the day-to-day assessment and management of cybersecurity risks.
−Removed: Our senior vice president of information technology, or our SVP, IT, has primary oversight of material risks from cybersecurity threats and leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes, including through his management of, and participation in, the cybersecurity risk management and strategy processes described above, and his oversight of our incident response plans and escalation procedures described below.
−Removed: Our SVP, IT reports to our chief operating officer, or COO, and is an experienced information technology leader with over 25 years of expertise in cybersecurity defense, both in academic and corporate environments.
+Added: Our chief information technology officer, or CIO, has primary oversight of material risks from cybersecurity threats and leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes, including through his management of, and participation in, the cybersecurity risk management and strategy processes described above, and his oversight of our incident response plans and escalation procedures described below.
+Added: Our CIO reports to our chief financial and operating officer and is an experienced information technology leader with over 25 years of expertise in cybersecurity defense, both in academic and corporate environments.
This experience includes, but is not limited to, data defense, perimeter and infrastructure defense, corporate risk awareness, compliance adherence, and cybersecurity training and leadership.
−Removed: We have also established a cross-functional information security counsel, or ISC, led by our SVP, IT, that brings together representatives from across the organization, including from our IT, finance, clinical, human resources, research and
−Removed: development, program leadership, facilities, and legal functions, that is responsible for reviewing, responding, mitigating and reporting all cybersecurity incidents.
+Added: We have also established a cross-functional information security counsel, or ISC, led by our CIO, that brings together representatives from across the organization, including from our IT, finance, clinical, human resources, research and development, program leadership, facilities, and legal functions, that is responsible for reviewing, responding, mitigating and reporting all cybersecurity incidents.
The ISC meets quarterly and on an ad hoc basis, as necessary.
In the event of a cybersecurity incident, our ISC is promptly convened and follows a standardized review and mitigation process and incident response plan, which includes escalation to our data protection committee, or DPC.
−Removed: Our DPC is composed of our SVP, IT, our COO, our senior vice president, finance and accounting, and senior members of our legal and IT teams and is responsible for assessing, among other factors, the actual or potential operational, business, financial, legal or reputational impact of a cybersecurity incident on the Company.
+Added: Our DPC is composed of our CIO, our chief financial and operating officer, our senior vice president, finance and accounting, and senior members of our legal and IT teams and is responsible for assessing, among other factors, the actual or potential operational, business, financial, legal or reputational impact of a cybersecurity incident on us.
The DPC is also responsible for notifying the audit committee of the board of directors in the event of a significant cybersecurity threat or incident.
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.