4 unchanged sentences
The Corporation’s cybersecurity program is based on the Federal Financial Institutions Examination Council (“FFIEC”) framework which tailors the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework to be more financial services focused.
−Removed: The risk of cybersecurity threats is integrated into its Enterprise Risk Management (“ERM”) program, led by the Corporation’s Chief Risk Officer.
+Added: The risk of cybersecurity threats is integrated into the Corporation’s Enterprise Risk Management (“ERM”) program, led by the Corporation’s Chief Risk Officer.
The ERM program includes an annual risk prioritization process to identify key enterprise risks.
Each key risk is assigned a risk owner to establish action plans and implement risk mitigation strategies.
−Removed: The cybersecurity threat risk action plan is managed at the enterprise level by the Chief Information Technology & Security Officer (the “CITSO”), the VP of Information Technology, and the VP of Information Security.
−Removed: Each quarter, the risk owners review and update the cybersecurity threat risk action plan to provide the status on specific risk mitigation actions and to identify new threats.
+Added: The Corporation’s cybersecurity threat risk action plan is managed at the enterprise level by the Chief Information Technology & Security Officer (the “CITSO”), the VP of Information Technology, and the VP of Information Security.
+Added: Risk owners regularly monitor cybersecurity risks and the evolving threat landscape and review and update the cybersecurity threat risk action plan in response to newly identified threats or risk mitigation actions.
To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third party service providers, the Corporation maintains a third-party security operations center with round-the-clock monitoring, and the CITSO receives regular reports on industry activity.
1 unchanged sentence
The assessment identifies cybersecurity-related risks and makes recommendations to enhance the security of all new computing services.
−Removed: The Corporation reassesses all suppliers on a regular interval.
+Added: Management reassesses all suppliers on a regular interval.
+Added: The Corporation maintains a Cybersecurity Incident Response Plan (the “CSIRP”), which establishes an organizational framework and guidelines intended to facilitate an effective response and handling of cybersecurity incidents that could jeopardize the availability, integrity, or confidentiality of the Corporation’s assets.
+Added: Pursuant to the CSIRP and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements.
+Added: While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the CITSO and the VP of Information Security primarily lead these efforts.
The Corporation works closely with its internal auditors to assess, identify, and manage cybersecurity risks.
2 unchanged sentences
Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Corporation, including its business strategy, results of operations or financial condition.
+Added: However, there can be no assurance that the Corporation’s security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging.
+Added: In addition, although the Corporation maintains cybersecurity insurance to provide some coverage for certain risks arising out of data and network breaches, there can be no assurance that the Corporation’ cybersecurity insurance coverage will be sufficient in the event of a cyber attack.
See “Item 1A.
2 unchanged sentences
The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats.
−Removed: Management, including the CITSO, reports on cybersecurity matters regularly to the Board, primarily through the Audit and IT Committees, including an annual report regarding specific risks and mitigation efforts within the Bank and a 3-year cybersecurity threat assessment conducted by third party experts.
−Removed: Management provides benchmarking information and updates on key operational and compliance metrics to the Board.
+Added: The boards of directors of the Corporation and the Bank have also established an IT Committee, consisting of at least three independent directors, along with non-voting members from management, including the President and CEO, the Chief Financial Officer, the CITSO, the SVP of Operations, the VP of Information Technology, and the VP of Information Security.
+Added: The IT Committee assists the boards of directors of the Corporation and CNB Bank in fulfilling their respective governance responsibilities for CNB’s information technology and related data security infrastructure under relevant regulatory safety and soundness requirements.
+Added: Management, including the CITSO, reports on cybersecurity matters regularly to the Board, primarily through the Audit Committee and IT Committee, including an annual report regarding specific risks and mitigation efforts within the Bank and a 3-year cybersecurity threat assessment conducted by third party experts.
+Added: Management provides benchmarking information and updates on key operational and compliance metrics to the Board of Directors.
In addition, cybersecurity training is provided to the full Board of Directors to educate directors on the current cyber threat environment and measures companies can take to mitigate risk and impact of cyber attacks.
−Removed: The Corporation maintains a Cybersecurity Incident Response Plan (the “CSIRP”), which establishes an organizational framework and guidelines intended to facilitate an effective response and handling of cybersecurity incidents that could jeopardize the availability, integrity, or confidentiality of the Corporation’s assets.
−Removed: The CSIRP outlines roles and responsibilities, criteria for measuring the severity of a cybersecurity incident, and an escalation framework, including processes for informing the General Counsel and the Board of Directors of material cybersecurity incidents.
+Added: Several members of the Board of Directors, including the Chairperson of the Audit Committee, also have cybersecurity experience.
As described above, management is actively involved in assessing and managing the Bank’s material cybersecurity risks.
−Removed: The CITSO and the VP of Information Security primarily lead these efforts.
+Added: The Corporation's incident response plan provides clear communication protocols, including with respect to members of senior management, which may include the CEO, the CFO, the Board of Directors, the Audit Committee and external legal counsel.
+Added: In addition, the incident response plan considers communications and reporting to customers, regulators and law enforcement.
The CITSO, who reports directly to the CEO, is responsible for the oversight of the Corporation’s IT operation, including the cybersecurity program, and holds a Bachelor of Science degree in Information Technology and Security and a Master of Science in Information Security and Assurance.
2 unchanged sentences
He holds a bachelor’s degree in mathematics and computer science, as well as several industry recognized information security certifications.
+Added: The VP of Information Technology reports directly to the CITSO and has responsibility for leadership of the Bank’s Information Technology program.
+Added: He holds a bachelor’s degree in information technology and has worked in the technology field for 29 years with 17 of those years in a financial institution in various technology management, security, and audit roles.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.