UNRESOLVED STAFF COMMENTS.
+Added: ITEM 1A., ITEM 1B., AND ITEM 1C.
THE CORPORATION’S CYBERSECURITY PROCESSES, POLICIES AND GOVERNANCE.
6 unchanged sentences
The Corporation operates in a fashion that allows operational risk to be in line with its risk appetite.
−Removed: To govern, monitor and control operational risk, the Corporation maintains an Enterprise Risk Management (“ERM”) Program, which sets thresholds for risk appetite by key risk areas, such as strategic risk and operational risk.
+Added: To govern, monitor and control operational risk, the Corporation maintains an ERM Program, which sets thresholds for risk appetite by key risk areas, such as strategic risk and operational risk.
These thresholds are monitored by the Compliance and Internal Audit Departments and key metrics are reported to management and Board committees.
5 unchanged sentences
Governance of third parties includes a due diligence and risk assessment prior to contract execution, with oversight completed based on a frequency defined by the third parties risk profile.
−Removed: The Corporation received written notice during 2023 that certain of its customer data was potentially included in the global incident involving Progress Software Corporation (“MOVEit Transfer”).
−Removed: The incident did not involve the Bank’s internal network or IT systems, but was rather related to a third party prominent financial institution vendor that utilized MOVEit Transfer in its service offering to the Bank.
−Removed: Based on the investigation, the Bank’s customers who use online and mobile banking could have had personal information copied through the cyberattack.
−Removed: The vendor confirmed that it implemented the recommended patches released by Progress Software Corporation for the platform.
−Removed: The Bank worked with the vendor to determine the potentially impacted customers and the extent of information potentially exposed and the Bank notified potentially affected customers appropriately.
−Removed: The incident did not impact the ongoing operations of the Bank and the Bank’s cyber insurance is expected to cover many of the costs related to the incident.
−Removed: The MOVEit Transfer incident is the only cybersecurity incident that materially affected the Corporation during the 2023 fiscal year.
To combat these ever-present cyber risks, the Corporation maintains a comprehensive Information Security Program, which includes annual risk assessments, an Incident Response Plan, and a layered control environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment.
2 unchanged sentences
The Corporation has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework for the management and development of cybersecurity controls and is an active participant in the financial sector information sharing organization structure, known as the Financial Services Information Sharing and Analysis Center.
−Removed: ITEM 1A., ITEM 1B., AND ITEM 1C.
The Corporation’s Chief Information Security Officer (CISO) is responsible for assessing and managing the Corporation’s risks from cybersecurity threats.
6 unchanged sentences
Management has established an Information Security Committee in order to assist executive management and the Board of Directors of the Bank in fulfilling their oversight responsibilities related to information security.
+Added: The Corporation’s Information Security Committee consists of members with diverse experience, including the Corporation’s leaders from information security, enterprise risk management, legal, bank protection, internal audit and various business units.
+Added: The Corporation’s information security professionals have a range of varying cybersecurity experience and education, many of whom have substantial experience assessing and managing cybersecurity initiatives and hold certain cybersecurity certificates.
The Corporation uses multiple assessors, consultants, auditors and other third parties in the fulfillment of the information security program.
−Removed: These third parties participate in testing and validation processes, as well as the execution of certain program-related controls.The Committee reports its activities, key conclusions and recommendations to the Enterprise Risk Management Committee and the Board’s Risk and Credit Policy Committee of the Board on a quarterly basis.
+Added: These third parties participate in testing and validation processes, as well as the execution of certain program-related controls.
+Added: The Committee reports its activities, key conclusions and recommendations to the Enterprise Risk Management Committee and the Board’s Risk and Credit Policy Committee of the Board on a quarterly basis.
At the Information Security Committee, security-related policies and standards are reviewed and recommended for approval, annual risk assessment results and action plans are noted, annual penetration test reports shared, current security incidents discussed, and relevant cyber risks and trends are presented.
10 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.