7 unchanged sentences
The Information Security Program also includes:
−Removed: (i) an Information Security Incident Response Procedure (the “Incident Response Procedure”), which delineates the processes for reporting, classifying, investigating, planning, containing, eradicating, recovering, documenting, and communicating information security incidents, as well as post-incident activities, and (ii) a Security Monitoring Policy, which establishes the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or manual), as well as various condition monitoring tests and reviews, and documentation requirements in connection with security incident identification.
+Added: (i) an Information Security Incident Response Procedure (the “Incident Response Procedure”), which delineates the processes for reporting, classifying, investigating, planning, containing, eradicating, recovering, documenting, and communicating information security incidents, as well as post-incident activities;
+Added: and (ii) a Security Monitoring Policy, which establishes the rules and requirements for enabling, logging, alerting, and monitoring real time security alerts and security logs (automated or
+Added: manual), as well as various condition monitoring tests and reviews, and documentation requirements in connection with security incident identification.
Potential information security incidents are identified in a number of ways, including, but not limited to:
users reporting security violations, system weaknesses, violations of our Information Security Acceptable Use Policy, which addresses the boundaries of acceptable use of our information technology assets, automated system alerts, and monitoring of both system generated and manually generated logs.
−Removed: Our Information Security Program mandates that any potential information security incident response begin at the initial internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it
−Removed: has not resulted from a false positive.
+Added: Our Information Security Program mandates that any potential information security incident response begin at the initial internal communication and investigation stage, during which such events undergo initial investigation for validation, including related to the scope and depth of such incident and to ensure that it has not resulted from a false positive.
Internal communications regarding the potential incident occur with the relevant security coordinator according to our Incident Response Procedures.
7 unchanged sentences
Following any such incident, we engage in follow-up to communicate with law enforcement and notify impacted third parties and customers, as appropriate, in addition to further investigating the cause of the incident, documenting takeaways, and engaging in remediation.
−Removed: Our Chief Information Security Officer (“CISO”) coordinates with other members of our executive management team identified in our Information Security Program to document, validate, respond, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis.
−Removed: The CISO also provides quarterly reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board's general risk management oversight role, as described in further detail below.
−Removed: The CISO and the Chief Information Officer (“CIO”) have shared responsibility for overseeing day-to-day operations of the Information Security Program, coordinating or contributing to reviews, audits, risk assessments, and other risk management material, development of departmental policies and procedures for board approval, and periodic updates to our information technology steering committee and/or the full board of directors.
−Removed: The CIO reports to President and Chief Executive Officer, while the CISO reports to the Chief Regulatory Officer and reports regularly to the Audit Committee.
+Added: Our Director of Information Security (“DIS”) coordinates with other members of our executive management team identified in our Information Security Program to document, validate, respond to, and manage actual or potential security incidents according to their threat classifications as described above, and report to our board of directors and/or the Audit Committee on an ad hoc basis.
+Added: The DIS also provides quarterly reports on the status of our Information Security Program and its compliance with regulatory requirements to our board of directors in connection with our board’s general risk management oversight role, as described in further detail below .
+Added: The DIS and the Chief Information Officer (“CIO”) have shared responsibility for overseeing day-to-day operations of the Information Security Program;
+Added: coordinating or contributing to reviews, audits, risk assessments, and other risk management material;
+Added: development of departmental policies and procedures for board approval;
+Added: and periodic updates to our information technology steering committee and/or the full board of directors.
+Added: The CIO reports to the President and Chief Executive Officer, while the DIS reports to the Chief Regulatory Officer and reports regularly to the Audit Committee.
The CIO has 20 years of industry experience including management of technology, security, data analytics, and vendor relationships.
−Removed: The CISO has over 10 years of industry experience including management of security and vendor relationships as well as possesses several industry certifications, including certification as a Certified Information Systems Security Professional from the International Information System Security Certification Consortium and as a Certified Information Security Manager from the Information Systems Audit and Control Association.
−Removed: With the approval of Audit Committee, we also engage third party assessors, consultants, and auditors in connection with the Company’s Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments.
+Added: The DIS has over 10 years of industry experience and 25 years of information security experience focusing on management of security and vendor relationships.
+Added: The DIS also possesses several industry certifications, including certification as a Certified in Risk and Information Systems Control and Certified Information Security Manager from the Information System Audit and Control Association.
+Added: With the approval of the Audit Committee, we also engage third-party assessors, consultants, and auditors in connection with the Company’s Information Security Program and in accordance with our Audit Program, including to conduct external and internal penetration testing, independent audits, and risk assessments.
We may also utilize third-party service providers in the ordinary course of business, including to assist us in performing information security assessments for third-party service providers that store or process our confidential data.
5 unchanged sentences
Our executive management team is responsible for the development of our policies and procedures and for managing any exception to the same.
−Removed: In particular, our CISO oversees information security compliance, as described above.
−Removed: The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and
−Removed: approval of our policies and procedures related to cybersecurity.
+Added: In particular, our DIS oversees information security compliance, as described above.
+Added: The board of directors of the Company has ultimate oversight of cybersecurity-related risk and activities, including the review and approval of our policies and procedures related to cybersecurity.
The Information Security Program is approved on an annual basis.
Cybersecurity risk management is also incorporated into our overall enterprise risk management model, which is updated on a quarterly basis and subject to oversight by our board of directors.
−Removed: In the ordinary course of business, our board of directors receives quarterly updates from the CISO regarding the Information Security Program and compliance with relevant regulations, as described above.
−Removed: Members of the Audit Committee of our board of directors also attend the meetings of our information technology steering committee on a quarterly basis.
+Added: In the ordinary course of business, our board of directors receives quarterly updates from the DIS regarding the Information Security Program and compliance with relevant regulations, as described above.
+Added: Members of the Audit Committee of our board of directors receive presentations as well as minutes of the meetings of our information technology steering committee on a quarterly basis.
Our information technology steering committee consists of members of our board of directors who have relevant experience from their audit and management experience as well as training provided by our management.
−Removed: If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors and/or Audit Committee sooner than its next quarterly update.
+Added: If an incident occurs, depending on its priority as identified through the procedures described above, management may inform our board of directors and/or the Audit Committee sooner than its next quarterly update.
See the section entitled “Part I, Item 1.
2 unchanged sentences
As a regulated financial institution, the Bank is also subject to financial privacy laws, and our cybersecurity practices are subject to oversight by the federal banking agencies.
−Removed: In addition, the SEC recently enacted rules, effective as of December 18, 2023, requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.
+Added: In addition, the Bank is subject to SEC rules requiring public companies to disclose material cybersecurity incidents that they experience on Form 8-K within four business days of determining that a material cybersecurity incident has occurred and to disclose on an annual basis material information regarding their cybersecurity risk management, strategy, and governance.
For additional information, see the section entitled “Part I, Item 1.
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.