1 unchanged sentence
ITEM 1A., ITEM 1B., AND ITEM 1C.
−Removed: THE CORPORATION’S CYBERSECURITY PROCESSES, POLICIES AND GOVERNANCE.
+Added: CYBERSECURITY
+Added: CYBERSECURITY PROCESSES, POLICIES AND GOVERNANCE
The increased use of, and dependence on, information management systems in order to engage with customers and conduct business necessarily creates cyber risk.
−Removed: Despite the significant resources and security measures used by the Corporation, the incentives for threat actors to obtain financial payment information and customer non-public information, or to conduct ransomware will continue to exist.
+Added: Despite the significant resources and security measures used by the Corporation, the incentives for threat actors to obtain financial payment information and customer non-public information, or to conduct ransomware attacks, will continue to exist.
Cyber breach statistics over the past several years evidence the targeting of numerous banking institutions and credit bureaus.
−Removed: Phishing attempts have also significantly increased and political conflict also presents cyber threats by nation states.
−Removed: Operational risk is inherent in the Corporation’s activities and can present itself in numerous ways, including internal or external fraud, business disruptions or failures, noncompliance with applicable laws and regulations, cyber breach, or failure of third parties, among other events.
−Removed: The result of these could be reputational harm, financial losses, or litigation and regulatory fines for the Bank.
+Added: Phishing attempts have also significantly increased and political conflict also presents cyber threats from nation states.
+Added: Operational risk is inherent in the Corporation’s activities and can present itself in numerous ways, including internal or external fraud, business disruptions or failures, noncompliance with applicable laws and regulations, cyber breaches, or failure of third parties, among other events.
+Added: The result of these could be reputational harm, financial losses, or litigation and regulatory fines to the Corporation.
The Corporation operates in a fashion that allows operational risk to be in line with its risk appetite.
1 unchanged sentence
These thresholds are monitored by the Compliance and Internal Audit Departments and key metrics are reported to management and Board committees.
−Removed: The ERM Program includes managing material risks from cybersecurity threats.
−Removed: Use of third-party software and services also exposes the Corporation to cybersecurity risk as numerous service providers host critical data or have direct contact with our bank customers.
−Removed: Although the Corporation adheres to industry standard practices in conducting thorough due diligence of vendors and contract management, should a vendor experience a breach the bank could still suffer reputational harm, and potentially financial losses.
+Added: The ERM Program includes processes for identifying, assessing, and managing material risks from cybersecurity threats.
+Added: Use of third-party software and services also exposes the Corporation to cybersecurity risk as numerous service providers host critical data or have direct contact with our customers.
+Added: Although the Corporation adheres to industry standard practices in conducting thorough due diligence of vendors and contract management, should a vendor experience a breach, the Corporation could still suffer reputational harm and potentially financial losses.
Expanded use of cloud-based technologies and providing our customers more internet-based product offerings to continue to remain competitive will serve to increase these potential risks.
The Corporation’s Third-Party Risk Management Program helps to mitigate risks posed by reliance on third and fourth parties.
−Removed: Governance of third parties includes a due diligence and risk assessment prior to contract execution, with oversight completed based on a frequency defined by the third parties risk profile.
+Added: Governance of third parties includes a due diligence and risk assessment prior to contract execution, with oversight completed based on a frequency defined by the third party’s risk profile.
To combat these ever-present cyber risks, the Corporation maintains a comprehensive Information Security Program, which includes annual risk assessments, an Incident Response Plan, and a layered control environment meant to detect, prevent, and limit unauthorized or harmful actions across our information technology environment.
−Removed: Policies over information security are Board-approved and various types of control testing is conducted throughout the year, both by internal and external parties.
−Removed: Findings are actioned on throughout the year and reported to various committees.
+Added: Information security policies are Board-approved and various types of control testing are conducted throughout the year, both by internal and external parties.
+Added: Findings are remediated throughout the year and reported to various committees.
The Corporation has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework for the management and development of cybersecurity controls and is an active participant in the financial sector information sharing organization structure, known as the Financial Services Information Sharing and Analysis Center.
−Removed: The Corporation’s Chief Information Security Officer (CISO) is responsible for assessing and managing the Corporation’s risks from cybersecurity threats.
−Removed: The CISO is an active Certified Information Security Systems Professional and has been with the organization for 18 years with over 21 years of experience in technology infrastructure and security.
+Added: The Corporation’s CISO is responsible for assessing and managing the Corporation’s risks from cybersecurity threats.
+Added: The CISO holds a Certified Information Security Systems Professional credential and has been with the organization for 19 years with over 22 years of experience in technology infrastructure and security.
The Information Security Department conducts cyber incident tabletop exercises on an ongoing basis.
2 unchanged sentences
This allows our incident response team to become familiar with the logistics of the plan, as well as provide feedback to improve the process and plan.
−Removed: External subject matter experts, such as Bank legal counsel, forensic advisors, marketing agency and insurance broker participate in these exercises.
−Removed: Management has established an Information Security Committee in order to assist executive management and the Board of Directors of the Bank in fulfilling their oversight responsibilities related to information security.
−Removed: The Corporation’s Information Security Committee consists of members with diverse experience, including the Corporation’s leaders from information security, enterprise risk management, legal, bank protection, internal audit and various business units.
+Added: External subject matter experts, such as Bank legal counsel, forensic advisors, marketing agency and insurance broker may participate in these exercises.
+Added: Management has established an Information Security Committee in order to assist executive management and the Board of Directors in fulfilling their oversight responsibilities related to information security.
+Added: The Corporation’s Information Security Committee consists of members with diverse experience, including the Corporation’s leaders from information security, technology, enterprise risk management, legal, bank protection, internal audit and various business units.
The Corporation’s information security professionals have a range of varying cybersecurity experience and education, many of whom have substantial experience assessing and managing cybersecurity initiatives and hold certain cybersecurity certificates.
4 unchanged sentences
The Corporation’s Board of Directors has delegated primary responsibility for oversight of cybersecurity risk to its Risk and Credit Policy Committee , with its Audit Committee also considering cyber risk as part of financial oversight.
−Removed: The Information Security Department provides an annual update to the Risk and Credit Policy Committee of the Board on the state of the Information Security Program.
−Removed: This cybersecurity “deep dive” includes review of key security incidents and review of the Information Security Policy, Information Security Program, the Incident Response Plan, and the Acceptable Use Policy.
−Removed: The Board is then presented with the update by the Chair of the Risk and Credit Policy Committee.
+Added: The Information Security Department provides an annual update on the state of the Information Security Program, which includes a comprehensive review of key security incidents, the Information Security Policy, Information Security Program, the Incident Response Plan, and the Acceptable Use Policy.
+Added: This update incorporates quantitative and qualitative analyses and is benchmarked against the Board-approved risk appetite.
+Added: The annual update is presented to the Enterprise Risk Management Committee and the Risk and Credit Policy Committee of the Board, with a summary to the full Board.
The Board considers cybersecurity risks in business strategy by getting updates on the Bank’s cybersecurity risk assessment.
−Removed: It assesses the experience of management personnel responsible for preventing, mitigating, detecting and remediating any cyber incidents, including the Chief Information Security Officer.
+Added: It assesses the experience of management personnel responsible for preventing, mitigating, detecting and remediating any cyber incidents, including the CISO.
In 2022, the Board appointed Jason Sondhi to its Board of Directors.
−Removed: Sondhi has experience managing companies who provide endpoint detection and incident response, vulnerability scans, security information and event management, security employee training and vCISO services.
+Added: Sondhi has experience managing companies that provide endpoint detection and incident response, vulnerability scans, security information and event management, security employee training and vCISO services.
Sondhi’s cybersecurity expertise assists the Board in overseeing management’s cybersecurity related efforts.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.