2 unchanged sentences
Risk Management and Strategy
−Removed: Information security and privacy are an important part of our culture and foundational to our goal of delivering safe, secure and quality products and services.
+Added: Information security and privacy are an important part of our culture and are foundational to our goal of delivering safe, secure and quality products and services.
This philosophy is emphasized throughout the Bank by its Board of Directors, senior leaders, officers, managers and other employees to promote a Bank-wide culture of cybersecurity risk management.
1 unchanged sentence
This information can be of significant value to criminal actors, and, as described in "Item 1A.
−Removed: Risk Factors, cybersecurity incidents and other security breaches involving this information at the Bank, at our service providers or counterparties, may negatively impact our business or performance.
+Added: Risk Factors - Risks Related to Cybersecurity, Third Parties, and Technology", cybersecurity incidents and other security breaches involving this information at the Bank, at our service providers or counterparties, may negatively impact our business or performance.
+Added: Unauthorized access to our customers' confidential or proprietary information as a result of a cybersecurity incident or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers.
We have implemented a strategy to address threats to Bank assets and confidential information.
−Removed: Our information security program, under the responsibility of the Chief Information Officer and the Chief Compliance & Risk Management Officer, balances security risks with business goals and provides appropriate protections for the confidentiality, integrity and availability of Bank and customer information.
+Added: Our information security program, under the responsibility of the Chief Information Officer and the Chief Compliance & Risk Management Officer , balances security risks with business goals and provides appropriate protections for the confidentiality, integrity and
+Added: availability of Bank and customer information.
We annually benchmark our information security program to assess its strength as measured against recommended industry security best practices.
1 unchanged sentence
This model is composed of a variety of different components including administrative controls, technical controls and other safeguards.
−Removed: These various components are centrally managed and monitored, creating a multi-layered and interlocking cybersecurity defense system.
−Removed: Unauthorized access to our customers' confidential or proprietary information as a result of a cybersecurity incident or otherwise could expose us to reputational harm and litigation and adversely affect our ability to attract and retain customers.
−Removed: We maintain a variety of programs and policies to support the management of cybersecurity risk with a focus on prevention, detection and recovery processes.
−Removed: These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council ("FFIEC") cybersecurity guidance, Center for Internet Security ("CIS") Benchmarks, as well as various other regulatory requirements and industry-specific standards.
+Added: These components are centrally managed and monitored, creating a multi-layered and interlocking cybersecurity defense system.
+Added: We maintain programs and policies to support the management of cybersecurity risk with a focus on prevention, detection and recovery processes.
+Added: These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council ("FFIEC") cybersecurity guidance, Center for Internet Security ("CIS") Benchmarks, Cyber Risk Institute Profile, as well as various other regulatory requirements and industry-specific standards.
The Bank also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.
18 unchanged sentences
The Bank engages in the periodic assessment and testing of our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents.
−Removed: These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.
+Added: These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our
+Added: cybersecurity measures and planning.
We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits, penetration tests and independent reviews of our information security control environment and operating effectiveness.
4 unchanged sentences
Third-party services related to advice, assessments, auditing, testing and support related to cybersecurity and information technology processes and services, where appropriate, are also subject to the third-party risk program.
−Removed: Like other financial institutions, the Bank experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users.
+Added: Like other financial institutions, the Bank is targeted with malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users.
This malicious activity includes attempts at unauthorized access and implantation of computer viruses or malware.
−Removed: The Bank also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud.
+Added: The Bank is also targeted with large volumes of phishing and other forms of social engineering attempted for the purpose of perpetuating fraud.
Notwithstanding the breadth of our information security and privacy program, it may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse impact.
6 unchanged sentences
The Bank's Chief Information Officer provides an annual comprehensive update to the Board of Directors on the status of IT, and the plans for the future as well as quarterly updates which include any cyber incidents.
−Removed: The Bank's Chief Technology Officer provides annual training on cyber security topics and reports to the Board of Directors on the Bank's cyber incidents, if any.
−Removed: Cyber incidents with (i) the potential of materiality;
+Added: The Bank's Chief Information Officer or delegate provides annual training on cyber security topics and reports to the Board of Directors on the Bank's cyber incidents, if any.
+Added: Cyber incidents with (i) the potential of materiality, pursuant to SEC cybersecurity disclosure rules;
(ii) anticipated publicity;
3 unchanged sentences
The minutes and materials from the ITOC meetings are available to the Board of Directors on the Directors' Board Portal.
−Removed: The Bank's Information Security Officer provides the Board of Directors an annual report on all aspects of Information Security, including steps taken to minimize the risk of cyber incidents through training and testing employees on phishing, social engineering, etc.
+Added: The Bank's Information Security Officer provides the Board of Directors with an annual report on all aspects of Information Security, including steps taken to minimize the risk of cyber incidents through training and testing employees on phishing, social engineering, etc.
This annual report also includes an independent third-party assessment of the Bank's information security systems together with information on steps taken to address any identified weaknesses.
−Removed: The Board of Directors also participates in an annual evaluation of risk and is presented with management's assessment of the top risks, which generally includes several cybersecurity components.
+Added: The Board of Directors also participates in an annual evaluation of enterprise risk and is presented with management's assessment of the top risks, which generally include several cybersecurity components.
Material Cybersecurity Incidents
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.