15 unchanged sentences
The Senior Information Security Officer (ISO), along with both the Director of Information Technology (IT), and Director of Information Services are responsible for managing our cybersecurity risk program.
−Removed: The Director of IT and Director of Information Services report to the Chief Financial Officer and are responsible for designing and maintaining the company’s network security architecture, as well as the day-to-day management of key components of our cybersecurity risk program, including identity access management, vulnerability and patch management, intrusion prevention systems, and threat intelligence .
+Added: The Director of IT and Director of Information Services report to the Chief Operating Officer and are responsible for designing and maintaining the company’s network security architecture, as well as the day-to-day management of key components of our cybersecurity risk program, including identity access management, vulnerability and patch management, intrusion prevention systems, and threat intelligence .
The ISO reports to the Chief Risk Officer and provides guidance, oversight, monitoring, and challenge of first line activities.
1 unchanged sentence
Our Board of Directors and Board Risk Committee have delegated oversight authority to a management-level Risk Committee, which is comprised of executive and senior management leadership with cybersecurity technical and/or regulatory expertise.
−Removed: The Risk Committee meets quarterly and has primary responsibility and oversight for risk management strategies related to technology, information security, cybersecurity, fraud, privacy, business continuity, and resilience .
−Removed: The ISO and Director of IT present Information Security and Information Technology reporting, including updates on the external threat environment and our cybersecurity program, including our performance in identifying, preventing, detecting, mitigating, and remediating cybersecurity threats.
+Added: The management-level Risk Committee meets quarterly and has primary responsibility and oversight for risk management strategies related to information security, cybersecurity, fraud, privacy, business continuity, and resilience .
+Added: The ISO and Director of IT present Information Security reporting, including updates on the external threat environment and our cybersecurity program, including our performance in identifying, preventing, detecting, mitigating, and remediating cybersecurity threats.
This information is subsequently reported up to the Board Risk Committee.
1 unchanged sentence
This includes management’s actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks.
−Removed: The Board Risk Committee
−Removed: also has oversight of and establishment of risk appetite guidance through the approval of Policies and Programs including the information security and cybersecurity programs.
+Added: The Board Risk Committee also has oversight of and establishment of risk appetite guidance through the approval of Policies and Programs including the information security and cybersecurity programs.
Annual independent assessments of the Company’s cybersecurity program which are completed by external parties with the required expertise are also presented to the Board Risk Committee.
The Chief Risk Officer and ISO report to the Board and/or Board Risk Committee on cybersecurity risks.
−Removed: Senior officers from IT or Information Security discuss cybersecurity matters that arise between Committee and Board meetings with the Chief Financial Officer and/or the Chief Risk Officer, who will share these with the Company’s Executive Officers and Board members, as appropriate.
+Added: Senior officers from IT or Information Security discuss cybersecurity matters that arise between Committee and Board meetings with the Chief Operating Officer and/or the Chief Risk Officer, who will share these with the Company’s Executive Officers and Board members, as appropriate.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.