4 unchanged sentences
The Company’s risk management program for cybersecurity is integrated into our risk management and general compliance programs and processes.
−Removed: Our cybersecurity program utilizes a layered, defense-in-depth strategy to identify and mitigate cybersecurity threats.
+Added: Our cybersecurity program utilizes a layered strategy to identify and mitigate cybersecurity threats.
Our Information Security Officer ("ISO") is responsible for the day-to-day management of the Company’s global information security program, which includes defining policies and procedures to safeguard our information systems and data, conducting vulnerability, threat and third-party information security assessments, information security event management (i.e., responding to ransomware and other cyber-attacks, business continuity and recovery), evaluating external cyber intelligence, supporting industry cybersecurity efforts and working with governmental agencies.
5 unchanged sentences
The Company’s ISO works with independent, third-party consultants to assess the maturity of the Company’s cybersecurity program within the NIST Framework and to develop strategic areas of focus for the Company’s program commensurate with the Company’s business objectives.
−Removed: As part of the Company’s information security program, we leverage both internal and external assessments and partnerships with industry leaders to help approach information security company-wide.
+Added: The Company’s information security program incorporates both internal and independent assessments, as well as partnerships with industry leaders, to support a coordinated, company‑wide approach to information security.
Additionally, we maintain a comprehensive program that defines standards for the planning, sourcing, management, and oversight of third-party relationships and third-party access to our system, facilities, and/or confidential or proprietary data.
6 unchanged sentences
Cybersecurity Governance
−Removed: The Audit Committee and Risk Committee of the Board of Directors provide oversight of Company cybersecurity risks.
+Added: The Risk Committee of the Board of Directors provides oversight of the Company’s cybersecurity risks, ensuring that Board oversight of such risks remains appropriate and that risks are appropriately managed.
The Risk Committee conducts a minimum of one cybersecurity program update per year, including a review of capital spend, budget, and staffing, as well as periodic reports on cybersecurity threats, awareness training, and key risk indicators related to the Company’s progress on risk mitigation activities.
−Removed: Annually, the Audit Committee reviews and recommends to the Board approval of management's recommendations on cybersecurity insurance.
−Removed: The Risk Committee reviews the Company’s oversight related to cybersecurity risks, to ensure that Board oversight of such risks remains appropriate and that risks are appropriately managed.
−Removed: The Company’s Chief Information Officer ("CIO") oversees the Company’s information technology programs and investments.
−Removed: The Company’s CIO has over 20 years of information technology experience, including ten years in various information technology leadership roles.
−Removed: Our CIO holds a Bachelor of Science in Information Technology.
+Added: Additionally, on an annual basis, the Risk Committee reviews and recommends to the Board approval of management's recommendations on cybersecurity insurance.
+Added: The Company’s Chief Information Officer (“CIO”) oversees the Company’s information technology strategy, operations, and investments, ensuring that technology initiatives support business objectives, resiliency, and risk‑management priorities.
+Added: The CIO brings more than 25 years of experience in financial‑services technology leadership and holds a Bachelor of Science in Computer Engineering and a Master’s degree in Software Development and Management.
The Company’s Chief Security Officer ("CSO") reports to the Chief Risk Officer and oversees the Company’s information security programs.
−Removed: The CSO possesses over 20 years of Information Security and Technology experience.
−Removed: Our Risk Management Committee, which includes the Company’s Chief Risk Officer (Chair), Director of Risk Management and CSO, assesses and monitors the effectiveness of the Company’s cybersecurity risk management program.
−Removed: The Company’s internal audit function also performs independent reviews and validation of the program, including policies and procedures as determined by their annual risk assessment.
+Added: The Company’s Risk Management Committee is comprised of the Chief Risk Officer (Chair) and the CSO who assess and monitor the effectiveness of the Company’s cybersecurity risk‑management program.
+Added: Informed by the annual risk assessment, the Company’s internal audit function performs independent reviews and validation of the program, including assessments of policies and procedures.
Both the CIO and CSO regularly report to the Board’s Risk Committee on the Company’s identification, prevention, detection, mitigation, and remediation of cybersecurity risks and incidents.
−Removed: In 2024, the Risk Committee reviewed the Company’s cybersecurity program and maturity assessment, provided regular oversight of cybersecurity risks, with cybersecurity discussions and dashboard reviews of key performance indicators and risks during the course of the year.
−Removed: With respect to specific incidents, the Company leverages an incident response framework to elevate and evaluate specific incidents to the CIO and CSO, along with the Company’s senior leadership, including the finance, compliance, and legal functions.
−Removed: In the event of a potentially material cybersecurity incident, the Risk Committee would be immediately notified and briefed.
−Removed: In January 2025, the Company hired a Chief Technology Officer ("CTO"), who oversees the Company’s information technology programs and investments.
−Removed: The CTO now encompasses the responsibilities previously held by the Chief Information Officer.
+Added: In 2025, the Risk Committee reviewed the Company’s cybersecurity program and maturity assessment, provided regular oversight of cybersecurity risks, and received updates throughout the year through discussions and dashboard reviews of key performance indicators and emerging risks.
+Added: With respect to specific incidents, the Company uses an established incident‑response framework to escalate and evaluate incidents with the CIO and CSO, as well as senior leadership from the finance, compliance, and legal functions.
+Added: In the event of a potentially material cybersecurity incident, the Risk Committee is immediately notified and briefed .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.