13 unchanged sentences
The CISO maintains a scorecard which monitors and measures various cyber risks, including:
−Removed: Operational capability, including cyber defense, vulnerability management, and third-party risk management.
−Removed: Risk assessments, including GLBA assessments and attack simulations.
−Removed: Program maturity, i ncluding the NIST Cybersecurity Framework (CSF) and the Federal Financial Institutions Examination’s Council’s (FFIEC) maturity framework.
+Added: Operational capability, including access management, cyber defense, vulnerability management, and third-party risk management.
+Added: Risk assessments, including GLBA assessments, penetration assessments and attack simulations.
+Added: Program maturity, leveraging the NIST Cybersecurity Framework.
Internal and External Audit, including external assessments , internal audit results, and regulator exam results.
19 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.