2 unchanged sentences
Managing cybersecurity risk within Cass is an ongoing, multifaceted process aimed at safeguarding digital assets and sensitive information.
−Removed: Led by the Company’s Chief Information Security Officer (“CISO”) and overseen by the Executive IT Council, the Company has a dedicated team of security professionals to implement the Company’s information security processes.
−Removed: The Executive IT Council is comprised of the CEO, CFO, Chief information Officer (“CIO”), CISO, and all heads of business units that serve together to manage and oversee the Company’s IT program as a whole.
−Removed: As part of this function and at the direction of the CISO, the Executive IT Council is charged with approving and providing oversight of the IT solutions that enhance the Company’s security posture.
−Removed: As more fully described in “Governance” below, the CISO and CIO regularly report the Executive IT Council’s findings to the Audit and Risk Committee of the Board, and to the full Board, in an effort to provide a collaborative and multi-point cybersecurity program.
+Added: Led by the Company’s Chief Information Security Officer (“CISO”) and overseen by the Enterprise Risk Management Committee ("ERMC"), the Company has a dedicated team of security professionals to implement the Company’s information security processes.
+Added: The ERMC is comprised of the CEO, CFO, Chief Information Officer (“CIO”), CISO, President and Chief Operating Officer of Cass Commercial Bank, Vice President and Chief Operational Risk Officer, Chief HR Officer and General Counsel.
+Added: As part of this function and at the direction of the CISO, the ERMC is charged with approving and providing oversight of the IT solutions that enhance the Company’s security posture.
+Added: As more fully described in “Governance”
+Added: below, the CISO and CIO regularly report the ERMC's findings to the Audit and Risk Committee of the Board, and to the full Board, in an effort to provide a collaborative and multi-point cybersecurity program.
The Company also relies on certain critical third party IT vendors that support processing, transmission, and storage of data, which has become more critical given the information security risks that are intensified through the Company’s increased use of remote work arrangements.
24 unchanged sentences
The CISO is supported by an information security team, made up of two security analysts and one IT audit and compliance analyst.
−Removed: The security analysts monitor the Company’s security solutions and security event logs and responds to incidents and events when they occur.
+Added: The security analysts monitor the Company’s security solutions and security event logs and respond to incidents and events when they occur.
The IT audit and compliance analyst tracks remediation efforts, manages the Company’s third party risk program and works with internal and external auditors on all IT compliance activities.
−Removed: Members of the information security team hold cybersecurity certifications, such as a Certified Information Systems Security Professional ("CISSP") or Certified Information Security Manager certifications.
+Added: Members of the information security team hold cybersecurity certifications, such as the Certified Information Systems Security Professional ("CISSP") or Certified Information Security Manager certifications.
The CIO oversees all IT departments within the Company, including security and risk, and is the primary liaison between IT and the Board of Directors.
2 unchanged sentences
The CISO has a bachelor’s degree in Computer Science from the University of Illinois, holds the CISSP, Certified in Risk and Information Systems Control and Certified Chief Information Security Officer certifications, and has been active in the management of the Company’s security programs for more than a decade, serving in the CISO role since early 2023.
−Removed: The CISO and CIO provide monthly updates to the Executive IT Council on security incidents, compliance and patching metrics, as well as security related industry updates that might affect the Company’s business.
−Removed: Real time updates are also provided to the Executive IT Council as needed.
−Removed: The Executive IT Council approves all security related project expenditures and all members are a part of the Company’s incident response team.
+Added: AI related risks are considered as part of the overall cybersecurity program.
+Added: The Company maintains an AI governance framework designed to support the responsible development, deployment, and use of AI technologies and to manage associated cybersecurity and operational risks.
+Added: The AI Governance Committee, which is comprised of the CIO, CISO, General Counsel, Chief HR Officer, Vice President and Chief Operational Risk Officer, Vice President of Internal Audit and line of business representatives, oversees the policies, standards, and risk assessment processes designed to manage these risks.
+Added: The CISO and CIO provide monthly updates to the ERMC on security incidents, compliance and patching metrics, and security and AI related industry updates that might affect the Company’s business.
+Added: The ERMC approves all security related project expenditures, and all members are a part of the Company’s incident response team.
The Audit and Risk Committee, together with the full Board of Directors, actively oversees the Company’s cybersecurity program.
The Audit and Risk Committee receives reports on evolving cybersecurity standards and key metrics, including the number of incidents, response times, and effectiveness of safety controls from the CIO on a quarterly basis, and more frequently when necessary.
−Removed: These reports include updates on the activities of the Executive IT Council.
+Added: These reports include updates on the activities of the ERMC.
Changes to the Company’s information security policies and programs are approved by the Audit and Risk Committee.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.