4 unchanged sentences
While standard security operations address most day-to-day incidents, cyber risk includes motivated threat actors who often use advanced tools, techniques and processes to evade detection or inflict maximum damage to an organization's information assets.
−Removed: Cyber threats and attacks adapt and evolve rapidly, so First Financial works to continuously enhance controls and processes to protect its networks, applications, and data from attack, damage or unauthorized access.
−Removed: Critical components to the Company’s cyber risk control structure include corporate governance, threat intelligence, security operations, security awareness training and patch management programs.
+Added: Cyber threats and attacks adapt and evolve rapidly, and the Company works to continuously enhance controls and processes to protect its networks, applications, and data from attack, damage, or unauthorized access.
+Added: Critical components to the Company’s cyber risk control structure include corporate governance, access management, threat intelligence, security operations, security awareness training, and vulnerability management programs.
Cyber risk mitigation includes effectively identifying, protecting against, detecting, responding to, and recovering from cyber threats.
The Company’s cybersecurity program is overseen by its Chief Information Security and Privacy Officer (the “CISO”).
−Removed: The Company’s CISO has over 20 years’ experience in the information security industry, including a previous CISO position at a large global conglomerate based internationally, and as head of product security for a US-based large global conglomerate.
−Removed: The Company’s CISO also has previous financial services experiences as head of cyber defense for a large regional bank.
+Added: The Company’s CISO has over 25 years of experience in information security and technology governance, risk, and compliance, including a previous CISO position at a large regional bank.
+Added: The Company’s CISO has also held leadership roles in enterprise risk management and internal audit for large financial service organizations, as well as at a global audit, assurance, and advisory firm.
The CISO meets quarterly with and chairs the Cyber ERM Committee, which consists of representatives from the officer of enterprise security, information technology, risk, compliance, and other internal stakeholders, and presents quarterly to the Enterprise Risk Management Committee (“ERMC”), which includes executive and senior leadership of the Company, and the Risk and Compliance Committee of the Board of Directors (“Board Risk Committee”).
3 unchanged sentences
Risk assessments, including GLBA assessments and attack simulations.
−Removed: Program maturity, including MITRE and the Federal Financial Institutions Examination’s Council’s maturity framework.
+Added: Program maturity, i ncluding the NIST Cybersecurity Framework (CSF) and the Federal Financial Institutions Examination’s Council’s (FFIEC) maturity framework.
Internal and External Audit, including external assessments, internal audit results, and regulator exam results.
−Removed: The Company uses a variety of tools to monitor and mitigate cybersecurity risks, including employee training, phishing simulators, incident response tabletops, cybersecurity insurance and business continuity planning for the protection of the Company’s assets.
−Removed: Additionally, the Company’s cybersecurity function is audited on an annual basis by a third party using the MITRE ATTACK framework.
+Added: The Company uses a variety of tools to monitor and mitigate cybersecurity risks, including employee training, simulated phishing exercises, incident response tabletops, cybersecurity insurance, and business continuity planning for the protection of the Company’s assets.
+Added: Additionally, the Company’s cybersecurity function is audited on an annual basis by internal audit and external regulatory examiners.
The Company maintains an ad hoc committee comprised of senior management with responsibility for third party (vendor) risk management, including the CISO, the Chief Risk Officer, the Chief Compliance Officer, representatives from vendor management, and enterprise risk management associates.
1 unchanged sentence
Cyber diligence of critical vendors (vendors which store or interact with customers’ personally identifiable information) includes an annual review of the technology and data interfaces with the vendor, an annual review of the vendor’s cyber security controls, and monthly monitoring of the vendor’s outward-facing security posture.
−Removed: No risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition.
+Added: The Company is not aware of risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, which have materially affected the Company, including its business strategy, results of operations, or financial condition.
First Financial’s board of directors is responsible for overseeing the Company’s cybersecurity risk management objectives and risk tolerance as part of its oversight of the Company’s compliance and risk management activities.
Specific oversight of the cybersecurity function is delegated to the Board Risk Committee.
−Removed: The Chair of the Board Risk Committee has extensive cybersecurity experience, including both experience as a chief information security officer of a publicly traded financial
−Removed: institution and as an outside cybersecurity consultant.
+Added: The Chair of the Board Risk Committee has extensive cybersecurity experience, including both experience as a chief information security officer of a publicly traded financial institution and as an outside cybersecurity consultant.
The committee chairperson maintains CISSP and CRISC certifications.
9 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.