1 unchanged sentence
Cybersecurity.
−Removed: The Company's Board of Directors, in coordination with the Audit Committee of the Board of Directors (the Audit Committee), is responsible for overseeing the Company's risk management and information technology programs of which cybersecurity is a critical element.
−Removed: Management is responsible for the administration of the Company's cybersecurity policies, standards, procedures and practices.
−Removed: The Company's cybersecurity policies, standards, procedures, and practices are based on the Center for Internet Security (CIS) Critical Security Controls, a framework for companies to establish and evaluate cybersecurity policies, procedures and practices.
−Removed: The Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they arise.
+Added: Our Board of Directors, in coordination with the Audit Committee of the Board of Directors (the Audit Committee), is responsible for overseeing our risk management and information technology programs of which cybersecurity is a critical element.
+Added: Management is responsible for the administration of our cybersecurity policies, standards, procedures and practices.
+Added: Our cybersecurity policies, standards, procedures, and practices are based on the Center for Internet Security (CIS) Critical Security Controls, a framework for companies to establish and evaluate cybersecurity policies, procedures and practices.
+Added: We seek to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of our information systems or the information that we collect and store, by assessing, identifying and managing cybersecurity issues as they arise.
Cybersecurity Risk Management and Strategy
−Removed: The Company's cybersecurity risk management strategy focuses on several issues:
+Added: Our cybersecurity risk management strategy focuses on several issues:
Identification and Reporting:
−Removed: The Company has implemented a comprehensive approach to assessing, identifying and managing material cybersecurity threats and incidents.
−Removed: The Company's program includes controls and procedures to timely identify, classify and escalate certain cybersecurity incidents to provide management visibility and allow for direction from management as to the public disclosure and reporting of material incidents in a timely manner.
+Added: We have implemented a comprehensive approach to assessing, identifying and managing material cybersecurity threats and incidents.
+Added: Our program includes controls and procedures to timely identify, classify and escalate certain cybersecurity incidents to provide management visibility and allow for direction from management as to the public disclosure and reporting of material incidents in a timely manner.
Technical Safeguards:
−Removed: The Company implements current information technologies to support its cybersecurity practices.
−Removed: These technologies are designed to protect the Company's information systems from cybersecurity threats and include:
−Removed: email and internet protection, firewall and network security, intrusion detection and prevention systems, anti-malware endpoint detection and response, security event monitoring and alerting, high availability and replication, system configuration and asset management , backup and restoration processes, vulnerability and patch management, identity and access management and data encryption.
+Added: We implement current information technologies to support our cybersecurity practices.
+Added: These technologies are designed to protect our information systems from cybersecurity threats and include email and internet protection, firewall and network security, intrusion detection and prevention systems, anti-malware endpoint detection and response, security event monitoring and alerting, high availability and replication, system configuration and asset management, backup and restoration processes, vulnerability and patch management, identity and access management and data encryption.
These technologies and controls are continuously evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as audits by third-party specialists and certifications.
Incident Response and Recovery Planning:
−Removed: The Company has established and maintains a comprehensive incident response plan, designed to address the Company's response to a cybersecurity incident.
−Removed: Cross-functional members of the Company comprise the Incident response team to respond and disclose material incidents.
−Removed: The incident response plan
−Removed: defines pre-incident activities and preparation, classification of incidents, response team internal and external contacts, process flow of the response team, escalation of incidents to outside entities and law enforcement and frequency of review of the incident response plan.
−Removed: The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.
+Added: We have established and maintain a comprehensive incident response plan, designed to address our response to a cybersecurity incident.
+Added: Our cross-functional members comprise the incident response team to respond and disclose material incidents.
+Added: The incident response plan defines pre-incident activities and preparation, classification of incidents, response team internal and external contacts, process flow of the response team, escalation of incidents to outside entities and law enforcement and frequency of review of the incident response plan.
+Added: We conduct regular tabletop exercises (i.e., discussion-based simulations) to test these plans and ensure personnel are familiar with their roles in a response scenario.
Third-Party Risk Management :
−Removed: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, contractors, consultants and other external users of the Company’s systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on the Company’s cybersecurity systems.
+Added: We maintain a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, contractors, consultants and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems.
Third parties are regularly assessed to determine the need for cybersecurity auditing based on risk evaluation.
Education and Awareness:
−Removed: The Company provides regular, mandatory training and assessment for all levels of employees regarding cybersecurity threats as a means to equip the Company’s employees with effective tools to address cybersecurity threats, and to communicate the Company’s evolving information security policies, standards, processes, and practices.
−Removed: The Company conducts periodic assessment and testing of the Company’s policies, standards, processes, and practices including audits by independent third party specialists in a manner intended to address cybersecurity threats and events.
+Added: We provide regular, mandatory training and assessment for all levels of employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.
+Added: We conduct periodic assessment and testing of our policies, standards, processes, and practices including audits by independent third-party specialists in a manner intended to address cybersecurity threats and events.
Policies are reviewed and revised on a frequent basis for relevance and to maintain compliance.
−Removed: The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.
−Removed: The Board, in coordination with the Audit Committee, oversees the Company’s risk management and information technology programs, including the management of cybersecurity threats.
−Removed: The Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by the Company’s peers and third parties.
−Removed: The Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.
−Removed: On an annual basis, the Audit Committee discusses the Company’s approach to overseeing cybersecurity threats with the Company’s head of Information Technology and other members of senior management.
−Removed: The head of IT, in coordination with senior management, including the CFO, works collaboratively across the Company to implement a program designed to protect the Company’s information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company’s incident response and recovery plans.
−Removed: To facilitate the success of the Company’s cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents.
−Removed: Through ongoing communications with these teams, the head of IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.
−Removed: Material Affects of Cybersecurity Incidents
−Removed: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.
+Added: The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.
+Added: The Board, in coordination with the Audit Committee, oversees our risk management and information technology programs, including the management of cybersecurity threats.
+Added: The Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties.
+Added: The Audit Committee also receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk.
+Added: On an annual basis, the Audit Committee discusses our approach to overseeing cybersecurity threats with our head of Information Technology (IT) and other members of senior management.
+Added: Xencor's head of IT has 33 years of experience and has managed information technology in complex environments for 20 years.
+Added: In coordination with senior management, including the CFO, the head of IT works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans.
+Added: Cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents support the success of our cybersecurity program.
+Added: Ongoing communications with these teams are designed to keep the head of IT and senior management informed about the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.
+Added: Material Effects of Cybersecurity Incidents
+Added: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.