2 unchanged sentences
The Company regularly assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and tests those systems pursuant to the Company’s cybersecurity policies, standards, processes, and practices, which are integrated into the Company’s overall risk management program.
−Removed: We have adopted aspects of the ISO 27002 and NIST SP 800-37 Rev.
−Removed: 2 frameworks, to which risk management in relation to our information systems is aligned.
+Added: We have adopted aspects of the ISO 27002, NIST SP 800-37 Rev.
+Added: 2, and NIST Cybersecurity frameworks, to which risk management in relation to our information systems is aligned.
We categorize our information systems as either critical or secondary, depending on business value and/or risk of financial or compliance impact of cybersecurity incidents .
18 unchanged sentences
The assessments encompass an evaluation of the Company’s adherence to the Program, including the elements of the Program that are dictated by relevant laws, regulations, and the Company’s information security manual.
−Removed: Furthermore, the Company conducts periodic cybersecurity assessments and preparedness analyses, supervised by our designated Chief Information Security Officer (“CISO”).
+Added: Furthermore, the Company conducts periodic cybersecurity assessments and preparedness analyses, supervised by our Vice President, Engineering – Security, Compliance, and Trust , who maintains a CRISC certification, has more than twenty years of experience in information security, risk management, and regulatory compliance in the financial services industry, and serves as our designated Chief Information Security Officer (“CISO”).
At least annually, our internal audit team conducts a formal risk assessment and develops an audit plan that identifies, assesses, and prioritizes risks that include cybersecurity.
1 unchanged sentence
The audit plan is reassessed throughout the year, and the plan is subject to modification by our internal audit team, e.g., based on such considerations as changes to resources, business operations, or internal or external risk factors.
−Removed: The CISO, the Vice President, Engineering – Security, Compliance and Trust, or the Director of Engineering Security and Compliance also issues an annual written report to the board of directors on the Program and material cybersecurity risks.
+Added: The CISO also issues an annual written report to the board of directors on the Program and material cybersecurity risks.
The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity policies throughout its operations that are designed to address cybersecurity threats and incidents.
In particular, the Company has adopted and maintains written policies and procedures for the protection of Company’s information systems and nonpublic information stored on those systems, which are based on the Company’s risk assessment and that address all other specific topics as may be required by applicable laws and regulations.
+Added: The Company requires all team members with access to any of its information systems, including contractors, to complete social engineering, cybersecurity, and compliance training programs annually.
The Program includes processes to coordinate and facilitate the implementation of information security best practices and services throughout the Company and to comply with applicable cybersecurity requirements under federal and state laws and regulations, including, but not limited to, the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act of 1996, and the New York State Department of Financial Services Cybersecurity Requirements for Financial Services Companies, 23 NYCRR 500.
2 unchanged sentences
The Company routinely engages third-party industry experts to work in conjunction with our internal audit team in performing risk assessments of the Program and the Plan and of the Company’s execution of the Program and the Plan.
−Removed: The CISO, in coordination with the Director of Engineering Security and Compliance and the information security managers, is responsible for leading the assessment and management of cybersecurity risks.
+Added: The CISO, in coordination with the information security managers, is responsible for leading the assessment and management of cybersecurity risks.
The Company’s information security team has extensive experience in information security and previous information security work experience in several industries, including defense, manufacturing, and financial services.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.