5 unchanged sentences
As part of the Information Security Program, the Company has implemented preventative controls to minimize data loss, exposure and misuse.
−Removed: These controls are designed to be implemented prior to a threat event to avoid the likelihood and potential impact of inadvertent or intentional misuse, improper disclosure, damage or loss.
−Removed: In addition, the Information Security Program includes internal and external penetration testing, regular vulnerability assessments, detailed
−Removed: Table of Content s
−Removed: vulnerability management, data loss prevention controls, file access and integrity monitoring and reporting and threat intelligence.
−Removed: The Information Security Program is coordinated and primarily executed by our information security, technology, IT and operations personnel.
+Added: These controls are designed to be implemented before a threat event to avoid the likelihood and potential impact of inadvertent or intentional misuse, improper disclosure, damage or loss.
+Added: In addition, the Information Security Program includes internal and external penetration testing, regular vulnerability assessments, detailed vulnerability management, data loss prevention controls, file access, controls, data integrity monitoring and reporting, and threat intelligence.
+Added: The Information Security Program is coordinated and primarily executed by our information security, technology, and operations personnel.
The IT department is responsible for the oversight of all managed systems and implements and maintains appropriate controls to protect the confidentiality, integrity and availability of computerized data and information resources.
2 unchanged sentences
Network vulnerability scans are conducted daily.
−Removed: Coastal engages third party assessors, consultants and auditors in connection with the Information Security Program, including to conduct external penetration testing, independent audits and risk assessments.
+Added: Coastal engages third party auditors and consultants in connection with the Information Security Program, including conducting external penetration testing, independent audits and risk assessments.
Coastal also utilizes third party service providers in the ordinary course of business to provide services to customers and partners.
−Removed: These third-party service providers may store or process confidential information and personally identifiable information related to our customers or on behalf of our partners in order to perform those services for which they were engaged.
+Added: These third-party service providers may store or process confidential information and personally identifiable information related to our customers or on behalf of our partners to perform those services for which they were engaged.
Coastal has implemented a vendor management program to help ensure third-party relationships are effectively managed .
3 unchanged sentences
The ISO is a Senior Vice President and has served in such role since 2010.
−Removed: The ISO has over 38-years of financial institution experience, which includes, compliance, BSA, operations, physical security along with information security.
−Removed: The ISO provides an annual report to the Board on the overall status of the Information Security Program and on information technology incidents as necessary.
+Added: The ISO has over 38-years of combined financial institution experience, which includes compliance, BSA, operations, physical security and information security.
+Added: The ISO provides an annual report to the Board on the overall status of the Information Security Program and information technology incidents as necessary.
The SVP of Technology also has responsibility for cybersecurity matters and reports to the Management Risk Committee, which consists of members of senior management.
−Removed: The Technology Subcommittee of the Management Risk Committee focuses on 3 pillars:
+Added: The Technology Subcommittee of the Management Risk Committee focuses on three pillars:
Technology Strategy, InfoSec/Cyber, and Data.
−Removed: The SVP of Technology has served in that role since 2005 and the SVP, Head of Technology Operations and Implementation, who also supports the Information Security Program, has 23 years of financial technology experience, including previously as Director, Application Development and Vice President, Integration and Analytics.
−Removed: The Information Security Program is further supported by other members of Coastal’s management team, including the President, Chief Risk Officer, and the Chief Audit Executive.
The Board exercises oversight over the Information Security Program and reviews and approves the Information Security Program at least annually.
7 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.