2 unchanged sentences
Risk Management and Strategy
−Removed: The Company maintains an Information Security Program to support the management of cybersecurity risk as an integral component of the Company’s ERM framework.
+Added: The Company maintains an Information Security Program to support the management of cybersecurity risk as an integral component of the Company’s enterprise risk management (“ERM”) framework.
The Information Security Program encompasses the Company’s cybersecurity policies and practices, which focus on prevention, detection, mitigation and recovery from cybersecurity incidents.
In addition, as part of the Information Security Program, the Company has a Security Incident Response Policy and Plan to enable a coordinated response to protect the integrity, security and resiliency of the Company’s information systems, to mitigate the risk of cybersecurity incidents and to escalate information regarding certain cybersecurity incidents to the appropriate management personnel and Board members in a timely fashion.
−Removed: The Information Security Program follows a National Institute of Standards and Technology based Cybersecurity Framework and other applicable industry standards.
+Added: The Information Security Program follows the Cyber Risk Institute Profile, which is a framework aligned with regulatory expectations for managing cyber risk in financial institutions.
The Information Security Program is supported by our three lines of defense model of risk management.
1 unchanged sentence
In addition, the Information Security Team works in coordination with the individual business lines that have direct and primary responsibility and accountability for identifying, controlling and monitoring cybersecurity risk embedded in their business activities.
−Removed: The Information Security Team uses reputable industry service providers for security operations, monitoring, investigation and incident response.
−Removed: The Information Risk Management team conducts periodic assessments in collaboration with consulting services with expertise in the cybersecurity domains.
+Added: The Information Security Team uses industry service providers for security operations, monitoring, investigation and incident response, and the Bank also conducts periodic assessments in collaboration with consulting firms with cybersecurity domain expertise.
As the second line of defense, the ERM Team under the Chief Risk Officer independently monitors the cybersecurity risk framework across the Company, as well as the effectiveness of the Information Security Program, and third party vendors’ vulnerability and penetration tests against the Company’s network.
2 unchanged sentences
The ERM Team reports the status of the annual assessment of the effectiveness of the Information Security Program to the Chief Risk Officer, who reports to the Board’s ROC.
−Removed: When applicable, the Company obtains Statement on Standards for Attestation Engagement 18 reports or equivalent reports for vendor products and services hosted by third parties.
+Added: When applicable, the Company obtains Statement on Standards for Attestation Engagement No.
+Added: 18 reports or equivalent reports for vendor products and services hosted by third parties.
Internal Audit serves as the third line of defense and provides additional independent assurance and evaluates the effectiveness of cybersecurity risk management.
14 unchanged sentences
The Chief Risk Officer has held various leadership roles at the bank, including over 13 years previously serving as the Company’s Chief Financial Officer.
−Removed: The Chief Information Security Officer has over 20 years of work experience in cybersecurity at financial institutions.
+Added: The Chief Information Security Officer has over 25 years of work experience in technology and cybersecurity at financial institutions.
The majority of Information Security Team members have over 10 years of cybersecurity experience and cumulatively hold over 80 active professional certifications in related fields.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.