2 unchanged sentences
Cybersecurity
−Removed: The Company recognizes the importance of maintaining a cybersecurity risk management system designed to reduce the risks that cybersecurity threats pose to financial institutions.
−Removed: As such, the Company has adopted proactive and defensive safeguards intended to better protect the Company’s information assets and supporting infrastructures from technology-related attacks.
+Added: The Company recognizes the importance of maintaining a cybersecurity risk management program designed to reduce the risks that cybersecurity threats pose to financial institutions.
+Added: As such, the Company has adopted proactive and defensive safeguards intended to better protect the Company’s information assets and defend infrastructures from technology-related attacks.
The Company’s Board of Directors and management oversee its information security and cybersecurity risk management programs.
5 unchanged sentences
The Company maintains a variety of programs and policies to support the management of cybersecurity risk within the organization with a focus on prevention, detection and response processes.
−Removed: These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology as well as various other regulatory requirements and industry-specific standards.
+Added: These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology, Cyber Risk Institute Profile, as well as various other regulatory requirements and industry-specific standards.
The Company also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.
−Removed: The Company’s Information Technology (“IT”) team along with a Virtual Chief Information Security Officer (“vCISO”) provider has the primary responsibility for establishing appropriate policies and procedures that are responsive to cybersecurity threats and other information security risks.
+Added: The Company’s IT team, along with the vCISO has the primary responsibility for establishing appropriate policies and procedures that are responsive to cybersecurity threats and other information security risks.
The Company’s vCISO, as part of the Company’s Risk Management division, provides independent risk management oversight to the IT team.
16 unchanged sentences
Management Oversight
−Removed: The Company’s Enterprise Risk Management Committee (“ERM”) is a management committee that reviews and discusses critical information security risks that impact the Company, identifies solutions to address these risks and has oversight of the Company’s information technology and information security policies.
−Removed: The ERM Committee provides cybersecurity reports periodically to the Risk Management Committee and is comprised of the Company’s vCISO, information technology and enterprise risk management leaders, including the Virtual Chief Information Security Officer (“vCISO”), Chief Information Officer, and Chief Risk Officer.
+Added: The Company’s ERM Committee is a management committee that reviews and discusses critical information security risks that impact the Company, identifies solutions to address these risks and has oversight of the Company’s information technology and information security policies.
+Added: The ERM Committee provides cybersecurity reports periodically to the Risk Management Committee and is comprised of the Company’s vCISO, information technology and enterprise risk management leaders, including the vCISO, Chief Information Officer, and Chief Risk Officer.
The ERM Committee’s membership enables the ERM Committee to be informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, if any, in accordance with the Company’s incident response plans.
2 unchanged sentences
Prior to his current role, the vCISO served in both network security and IT audit roles, conducting services for banks of various sizes and complexities.
−Removed: The vCISO maintains their Certified Information Security Manager (CISM), Certified Banking Security Manager (CBSM), Certified Banking Security Technology Professional (CBSTP), and Certified Banking Cybersecurity Manager (CBCM) certifications and received his Bachelor of Science in Network Security and Administration.
+Added: The vCISO maintains their Certified Information Security Manager, Certified Banking Security Manager, Certified Banking Security Technology Professional, and Certified Banking Cybersecurity Manager certifications and received his Bachelor of Science in Network Security and Administration.
The Company’s vCISO reports to the Chief Risk Officer.
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.