3 unchanged sentences
Cyber Risk Management and Strategy
−Removed: We rely on digital technology to conduct our business operations and engage with our clients, business partners and employees.
−Removed: The technology that we, our clients, business partners and employees rely upon becomes more complex over time as do threats to our business operations from cyber intrusions, denial of service attacks, manipulation and other cyber misconduct.
−Removed: Information Security is an ongoing process of exercising the due care necessary to protect corporate, client and employee information and systems from unauthorized access, destruction, disclosure, disruption and modification of use.
Through a combination of security, risk and compliance resources, AB implements information security through a dedicated Information Security Program (" ISP ") that is intended to identify, assess and manage material risks from cybersecurity threats and which includes a focus on safeguarding information and assets from cyber threats, engaging in cyber threat monitoring and responding to actual or potential cyber incidents.
3 unchanged sentences
Enterprise risk, including cybersecurity risk, is overseen by the Audit and Risk Committee on behalf of the Board.
+Added: AllianceBernstein
Our CISO, with assistance from internal and external resources, is responsible for implementing and providing oversight of our ISP.
1 unchanged sentence
an information assurance concept in which multiple layers of security controls are distributed throughout an operating environment.
−Removed: The concept manages risk with diverse defensive strategies, so that if one layer of defense fails, another later of defense will attempt to compensate.
+Added: The defense-in-depth strategy manages risk with diverse defensive strategies, so that if one layer of defense fails, another layer of defense will attempt to compensate.
Our ISP features cybersecurity policies, standards and guidelines, committee governance, training, access controls and data controls.
We periodically execute table top exercises as a part of our ISP program.
−Removed: 2023 Annual Report 27
−Removed: Our ISP, together with our risk and compliance resources, proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) ensuring essential business functions remain available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur.
−Removed: Our security, risk and compliance resources are designed to prioritize IT and cybersecurity risk areas, identify solutions that minimize such risks, pursue optimal outcomes and maintain compliance standards.
−Removed: We also maintain an operational security function that has a real time response capability that triages potential incidents and triggers impact mitigation protocols.
−Removed: Additionally, we utilize third parties to conduct periodic cybersecurity assessments and our internal audit function includes certain cyber risk audits as part of its overall risk audit.
−Removed: We review the recommendations and findings from those assessments and audits and implement corrective and other measures as appropriate.
+Added: Our ISP, together with our risk and compliance resources, proactively manage the risk of threat from cybersecurity incidents through (i) implementing protocols to take cybersecurity considerations into account in adopting and onboarding our technology resources, (ii) monitoring IT controls to better ensure compliance with cybersecurity and other related legal and regulatory requirements, (iii) periodically assessing adherence by critical and material third parties we partner with to ensure that the appropriate risk management standards are met, (iv) essential business functions remaining available during a business disruption, and (v) regularly developing and updating response plans to address potential IT or cyber incidents should they occur.
+Added: We also maintain an operational security function that has a real time response capability that triages potential incidents and triggers, as appropriate, impact mitigation protocols.
+Added: Additionally, we utilize third parties to conduct periodic cybersecurity assessments to identify, assess, manage, and as appropriate, mitigate and respond to cybersecurity risks, and our internal audit function includes certain cyber risk audits as part of its overall risk audit.
Our cybersecurity processes rely predominantly on internal resources, but also include important third party resources for certain matters, including the aforementioned assessments as well as our continuous cybersecurity threat monitoring and initial incident reporting system.
−Removed: As part of our ISP, we also perform cyber risk assessments on our critical and material third party vendors during onboarding, then periodically thereafter.
−Removed: We have not had a cybersecurity incident that has materially affected, or was reasonably likely to, materially affect our business strategy, results of operations or financial condition.
−Removed: There are risks from cybersecurity threats that if they were to occur could materially affect our business strategy, results of operations or financial condition, including those discussed in Item 1A Risk Factors - Operations, Technology and Cyber-Related Risks although we do not currently believe that such a result is reasonably likely.
+Added: As part of our ISP, we also perform cyber risk assessments on our third party vendors where we deem appropriate based on our risk assessment of such vendors, then periodically thereafter.
+Added: As of the date of this report, the Company is not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, financial condition or results of operations.
+Added: However, there can be no assurance that the Company will not be materially affected by such risks.
+Added: See Item 1A Risk Factors - Operations, Technology and Cyber-Related Risks for a discussion of cybersecurity risks.
Cyber Risk Governance
2 unchanged sentences
The full Board is updated on an as needed basis.
−Removed: In the event of an immediate cyber threat to our business operations, our ISP would involve our General Counsel, who would promptly notify the Chairperson of the Audit and Risk Committee, as to the nature, timing and extent of the threat and our applicable contingency plans would go into effect.
−Removed: Our CRO, in collaboration with our CISO, is responsible for notifying the Audit and Risk Committee of world events or of other significant external events that may pose cybersecurity threats or material risks to our business continuity.
+Added: In addition, management updates the Audit and Risk Committee, as appropriate, regarding any material cybersecurity threats or incidents, as well as any incidents with lesser impact potential.
While our Board provides oversight of our cybersecurity risk environment, the ultimate responsibility for our processes for identifying, assessing and managing cybersecurity risks resides with management.
2 unchanged sentences
Management oversight of our ISP is provided by various governance committees including the Operational Risk Oversight Committee, the Information Security Risk Oversight Subcommittee and the Financial Crimes Control Oversight Subcommittee.
+Added: 2024 Annual Report 25
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.