21 unchanged sentences
Cybersecurity Governance
−Removed: The Audit Committee and Technology Committee of the Board of Directors provide oversight of Company cybersecurity risks.
−Removed: The Technology Committee conducts a minimum of one cybersecurity program update per year, including a review of capital spend, budget, and staffing, as well as periodic reports on cybersecurity threats, awareness training, and key risk indicators related to the Company’s progress on risk mitigation activities.
+Added: The Audit Committee and Risk Committee of the Board of Directors provide oversight of Company cybersecurity risks.
+Added: The Risk Committee conducts a minimum of one cybersecurity program update per year , including a review of capital spend, budget, and staffing, as well as periodic reports on cybersecurity threats, awareness training, and key risk indicators related to the Company’s progress on risk mitigation activities.
Annually, the Audit Committee reviews and recommends to the Board approval of management's recommendations on cybersecurity insurance.
−Removed: The Technology Committee reviews the Company’s oversight related to cybersecurity risks, to ensure that Board oversight of such risks remains appropriate and that risks are appropriately managed.
+Added: The Risk Committee reviews the Company’s oversight related to cybersecurity risks, to ensure that Board oversight of such risks remains appropriate and that risks are appropriately managed.
The Company’s Chief Information Officer ("CIO") oversees the Company’s information technology programs and investments.
−Removed: The Company’s CIO has over 20 years of information technology experience, including nine years in various information technology leadership roles.
+Added: The Company’s CIO has over 20 years of information technology experience, including ten years in various information technology leadership roles.
Our CIO holds a Bachelor of Science in Information Technology.
−Removed: The Company’s ISO reports to the Chief Risk and Operations Officer and oversees the Company’s information security programs.
−Removed: The Company’s ISO possesses over 20 years of Information Security and Technology experience.
−Removed: The ISO holds a Bachelor of Science in Computer Systems Engineering, an MBA, and a Master of Science in Information Security and Assurance, as well as multiple industry certifications including CISSP, CISM, CISA, CRISC, CDPSE, PMP, among others.
−Removed: Our Risk Management Steering Committee, which includes the Company’s Chief Risk and Operations Officer (Chair), CIO and ISO, assesses and monitors the effectiveness of the Company’s cybersecurity risk management program.
−Removed: Company’s internal audit function also performs independent reviews and validation of the program, including policies and procedures as determined by their annual risk assessment.
−Removed: Both the CIO and ISO regularly report to the Technology Committee on the Company’s identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents.
−Removed: In 2023, the Board reviewed the Company’s cybersecurity program and maturity assessment, while the Technology Committee and Audit Committee provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks during the course of the year.
−Removed: With respect to specific incidents, the Company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and ISO, along with the Company’s senior leadership, including the finance, compliance, and legal functions.
−Removed: In the event of a potentially material cybersecurity incident, the Technology Committee and Audit Committee would be immediately notified and briefed.
+Added: The Company’s Chief Security Officer ("CSO") reports to the Chief Risk Officer and oversees the Company’s information security programs.
+Added: The CSO possesses over 20 years of Information Security and Technology experience.
+Added: Our Risk Management Committee, which includes the Company’s Chief Risk Officer (Chair), Director of Risk Management and CSO, assesses and monitors the effectiveness of the Company’s cybersecurity risk management program.
+Added: The Company’s internal audit function also performs independent reviews and validation of the program, including policies and procedures as determined by their annual risk assessment.
+Added: Both the CIO and CSO regularly report to the Board's Risk Committee on the Company’s identification, prevention, detection, mitigation and remediation of cybersecurity risks and incidents.
+Added: In 2024, the Risk Committee reviewed the Company’s cybersecurity program and maturity assessment, provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks during the course of the year.
+Added: With respect to specific incidents, the Company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and CSO, along with the Company’s senior leadership, including the finance, compliance, and legal functions.
+Added: In the event of a potentially material cybersecurity incident, the Risk Committee would be immediately notified and briefed.
+Added: In January 2025, the Company hired a Chief Technology Officer ("CTO"), who oversees the Company’s information technology programs and investments.
+Added: The CTO now encompasses the responsibilities previously held by the Chief Information Officer.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.