14 unchanged sentences
Additionally, management conducts both bottom-up and top-down enterprise risk assessments, which include cyber security risk, and continuously monitors industry and government threat intelligence to identify emerging risks and ensure continued program effectiveness.
−Removed: For additional discussion, on cybersecurity risk, see Item 1A.
−Removed: Risk Factors, section 1.08 “Unauthorized disclosure of sensitive or confidential information, whether through a cyber-attack, or breach of our computer systems or any other means, severely harm our business.”
−Removed: The Senior Information Security Officer, Director of Information Technology (IT), and Director of Information Services are responsible for managing our cybersecurity risk program.
−Removed: The Director of IT and Director of Information Services report to the Chief Administrative Officer and are responsible for designing and maintaining the company’s network security architecture, as well as the day-to-day management of key components of our cybersecurity risk program, including identity access management, vulnerability and patch management, intrusion prevention systems, and threat intelligence.
−Removed: The Senior Information Security Officer (ISO) reports to the Chief Risk Officer and provides guidance, oversight, monitoring, and challenge of first line activities.
+Added: The Senior Information Security Officer (ISO), along with both the Director of Information Technology (IT), and Director of Information Services are responsible for managing our cybersecurity risk program.
+Added: The Director of IT and Director of Information Services report to the Chief Financial Officer and are responsible for designing and maintaining the company’s network security architecture, as well as the day-to-day management of key components of our cybersecurity risk program, including identity access management, vulnerability and patch management, intrusion prevention systems, and threat intelligence .
+Added: The ISO reports to the Chief Risk Officer and provides guidance, oversight, monitoring, and challenge of first line activities.
The ISO is responsible for the development and management of our information security program, which includes cybersecurity risk assessments, incident response, third-party risk management, and testing of first line activities.
−Removed: Our Board of Directors and Executive Officer Committee have delegated oversight authority to a management-level IT/Operations Committee, which is comprised of executive and senior management leadership with cybersecurity technical and/or regulatory expertise.
−Removed: The IT/Operations Committee meets quarterly and has primary responsibility and oversight for risk management strategies related to technology, information security, cybersecurity, fraud, privacy, business continuity, and resilience.
+Added: Our Board of Directors and Board Risk Committee have delegated oversight authority to a management-level Risk Committee, which is comprised of executive and senior management leadership with cybersecurity technical and/or regulatory expertise.
+Added: The Risk Committee meets quarterly and has primary responsibility and oversight for risk management strategies related to technology, information security, cybersecurity, fraud, privacy, business continuity, and resilience .
The ISO and Director of IT present Information Security and Information Technology reporting, including updates on the external threat environment and our cybersecurity program, including our performance in identifying, preventing, detecting, mitigating, and remediating cybersecurity threats.
2 unchanged sentences
This includes management’s actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks.
−Removed: The Board Risk Committee also has oversight of and establishment of risk appetite guidance through the approval of Policies and Programs including the information security and cybersecurity programs.
+Added: The Board Risk Committee
+Added: also has oversight of and establishment of risk appetite guidance through the approval of Policies and Programs including the information security and cybersecurity programs.
Annual independent assessments of the Company’s cybersecurity program which are completed by external parties with the required expertise are also presented to the Board Risk Committee.
−Removed: The Chief Administrative Officer and Chief Risk Officer report to the Board and/or Board Risk Committee on cybersecurity risks and other matters reviewed by the IT/Operations Committee.
−Removed: Senior officers from IT or Information Security discuss cybersecurity matters that arise between Committee and Board meetings with the Chief Administrative Officer and/or the Chief Risk Officer, who will share these with the Company’s Executive Officers and Board members, as appropriate.
+Added: The Chief Risk Officer and ISO report to the Board and/or Board Risk Committee on cybersecurity risks.
+Added: Senior officers from IT or Information Security discuss cybersecurity matters that arise between Committee and Board meetings with the Chief Financial Officer and/or the Chief Risk Officer, who will share these with the Company’s Executive Officers and Board members, as appropriate.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.