5 unchanged sentences
We have implemented cybersecurity risk management processes that include, for example, vulnerability assessments, application security assessments, penetration testing, third party security assessments, security audits, and ongoing risk assessments.
−Removed: In addition, we have implemented technical, physical, and organizational safeguards designed to mitigate material risks from cybersecurity threats, including, for example, depending on the environment or system:
+Added: In addition, we have implemented certain technical, physical, and organizational safeguards designed to mitigate material risks from cybersecurity threats, including, for example, depending on the environment or system:
information security policies and standards, data protection policies and standards, security training and awareness campaigns, information protection processes, and systems monitoring for cybersecurity threats.
−Removed: We have also implemented an Incident Response Plan and procedures that provide a framework for responding to cybersecurity incidents.
−Removed: The Incident Response Plan and procedures provide protocols for incident evaluation, including the use of third-party service providers, processes for notification, and internal escalation of information to our senior management and the appropriate Board committee(s).
+Added: We have also implemented an Incident Response Plan and procedures that provide us with a framework for responding to cybersecurity incidents.
+Added: The Incident Response Plan and procedures provide protocols for incident evaluation, including the use of third-party service providers, processes for notification, and internal escalation of information to our senior management and the appropriate Board committee(s), all as appropriate depending on the nature of the incident.
The Incident Response Plan is reviewed and updated, as necessary, under the leadership of Zoom’s Chief Information Security Officer (“CISO”).
4 unchanged sentences
We perform risk-based due diligence and ongoing monitoring of third parties, which may include, for example:
−Removed: reviewing the third party’s relevant security audits and assessments;
−Removed: conducting our own security assessments, and imposing contractual obligations related to information security.
−Removed: For a description of the risks from cybersecurity threats that may materially affect us, see “Part I, Item 1A.
+Added: reviewing the third party’s relevant security audits and assessments, conducting our own security assessments, and imposing contractual obligations related to information security.
+Added: As of the date of this Annual Report on Form 10-K, we do not believe any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.
+Added: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see the risk factor titled "Our security measures, and those of the third parties with whom we work, have been compromised in the past and may be compromised in the future.
+Added: If our security measures are compromised in the future or if our information technology fails, this could harm our reputation, expose us to significant fines and liability, impair our sales, and harm our business.
+Added: In addition, our products and services may be perceived as not being secure.
+Added: This perception may result in customers and users curtailing or ceasing their use of our products, us incurring significant liabilities, and our business being harmed" in Part I, Item 1A.
Risk Factors of this Annual Report on Form 10-K.
2 unchanged sentences
Our CISO, Michael Adams, leads the team responsible for implementing and maintaining our information security program and reports directly to the Chief Operating Officer (“COO”), who reports directly to our Chief Executive Officer (“CEO”).
−Removed: Adams is a graduate of the United States Naval Academy and brings nearly 30 years of security and leadership experience, including serving as Deputy General Counsel of NATO's International Security Assistance Force Joint Command, Deputy General Counsel of the United States' Military's Pacific Command, and Deputy General Counsel for two Chairmen of the Joint Chiefs of Staff of the United States, as well as an executive at a leading technology company.
−Removed: Adams previously also served as Zoom's Chief Counsel to the COO and CISO.
+Added: Adams is a graduate of the United States Naval Academy and brings nearly 30 years of security and leadership experience, including serving as Deputy General Counsel of NATO's International Security Assistance Force Joint Command, Deputy General Counsel of the United States' Military's Pacific Command, and Deputy
+Added: General Counsel for two Chairmen of the Joint Chiefs of Staff of the United States, as well as an executive at a leading technology company.
+Added: Adams previously served as Zoom's Chief Counsel to the COO and CISO.
The CISO provides regular briefings to our senior management and the Cybersecurity Risk Committee concerning relevant cybersecurity risks and the processes we have implemented to address them.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.