4 unchanged sentences
The Information Security Department reports to the Chief Information Security Officer (CISO) and then directly to the Chief Risk Officer , to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis.
−Removed: Results of the information and cybersecurity evaluation and recommendations established by the Information Security Department are reported to the Risk Management Council no less than quarterly, and the results are then shared with the Board Risk Committee.
+Added: An Information Technology (IT) and Information Security Risk Assessment is conducted to identify further opportunities for improvement and are presented to Enterprise Risk Management and the Board Risk Committee.
The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto.
4 unchanged sentences
The CISO has served FNB since 2016, and has a career over 25 years in information technology, enterprise risk and information security controls.
−Removed: The CISO is a Certified Information Systems Security Professional (CISSP).
−Removed: The CISO has a Bachelor’s degree in Criminal Justice with a minor in Computer Science.
−Removed: The CISO is supported by several managers including the following:
+Added: The CISO is a Certified Information Systems Security Professional (CISSP), has a Bachelor’s degree in Criminal Justice with a minor in Computer Science and is supported by several managers including the following:
+Added: • Director of Information Technology Risk and Compliance - CISSP with over 20 years of Information Technology, Data Center and Security Engineering experience.
• Manager of Cyber Security - CISSP with over 20 years of Information Technology and Systems Engineering experience.
−Removed: • Manager of Security Architecture - CISSP with over 20 years experience in Information Technology networking, network security and security engineering.
+Added: • Manager of Security Architecture - CISSP with over 20 years of experience in Information Technology networking, network security and security engineering.
+Added: • Manager of Security Access Management - A+, Network+ and Server+ certifications with over 20 years experience in Information Technology and Systems Administration.
The CISO chairs an Information Security Committee made up of other risk professionals, Information Technology and line of business leaders to maintain an understanding and balance between security and business functionality.
−Removed: A summary of the processes involved in our process of evaluating the effectiveness of information and cybersecurity controls is below.
+Added: A summary of our processes involved in evaluating the effectiveness of information and cybersecurity controls is below.
Risk Assessment Process .
−Removed: On an annual basis, a risk assessment and maturity analysis is performed for the FNB environment based on the NIST CSF Framework.
+Added: On an annual basis, a risk assessment and maturity analysis is performed for the FNB environment based on various frameworks such as CRI 2.0.
+Added: FFIEC, CIS and NIST CSF.
The risk assessment takes into consideration a combination of risks related to the identification, prevention, detection, response, and recovery from cyber events.
−Removed: The risk assessment considers the inherent risk and controls implemented in the FNB environment and measures the residual risk to ensure it is within the FNB risk tolerance.
+Added: assessment considers the inherent risk and controls implemented in the FNB environment and measures the residual risk to ensure it is within the FNB risk tolerance.
Vulnerability Management Process .
Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the FNB information systems environment.
−Removed: Identified vulnerabilities are classified and scored based on their Common Vulnerability Scoring System, known exploitation or malware impacting the vulnerability, and the age in the environment.
−Removed: We prioritize the patching of critical and severe vulnerabilities.
+Added: Identified vulnerabilities are classified and scored based on their Common Vulnerability Scoring System, known exploitation or malware impacting the vulnerability, and the age of the vulnerability in the environment.
+Added: We prioritize the patching and remediation of critical and severe vulnerabilities.
+Added: We also evaluate the effectiveness of our Security Awareness Program, including results from simulated phishing exercises, to measure user susceptibility and identify areas requiring enhanced training and control focus.
Threat Management Process .
4 unchanged sentences
The penetration tests review our customer-facing applications, our response to social engineering activities, overall external attack surface and internal vulnerabilities.
−Removed: Issues identified from the penetration tests are tracked and escalated to ensure appropriate remediation occurs before closure.
+Added: Penetration test issues are prioritized by risk level and subject to ongoing tracking and escalation to ensure that remediation efforts are completed effectively and verified before closure.
Security Architecture .
To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted.
−Removed: The architecture reviews entail a series of questions, the responses to which are reviewed with internal IT and third-party vendor contacts to ensure the implementation is meeting policies, is configured with strong security practices, and utilizes appropriate access controls.
+Added: Architecture reviews involve asking a structured set of questions and collecting the required documentation for any proposed system changes or new implementations.
+Added: The responses and materials are then reviewed collaboratively with internal IT teams and relevant third-party vendors to confirm that the design aligns with policy requirements, follows strong security practices and implements appropriate access controls.
Access Management .
22 unchanged sentences
We also post articles regarding common cybersecurity schemes on our intranet for our employees’ awareness.
−Removed: We have a Vendor Managemen t department that established policies and procedures to follow when utilizing third-party vendors and ensures that key risk components are mitigated based on our standards.
+Added: We have a Third-Party Risk Managemen t department that established policies and procedures to follow when utilizing third-party vendors and ensures that key risk components are mitigated based on our standards.
Third-party vendors are thoroughly vetted, approved and inventoried before partnership begins.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.