23 unchanged sentences
We have created and maintain a Crisis Management Plan as part of our overall Incident Response Plan which provides for the escalation path and management of an incident by the appropriate designated executives.
−Removed: The Incident Response Plan is coordinated through the Chief Information Security Officer and key members of the information technology management team are embedded by design.
+Added: The Incident Response Plan is coordinated through the CISO and key members of the information technology management team are embedded by design.
The Crisis Management Plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.
−Removed: Further, our risk from cybersecurity threats includes failure in or breach of our operational or security systems or infrastructure managed by third-party vendors and extends to other third parties, which could disrupt our businesses, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs, and/or cause losses.
−Removed: While we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected the Company.
+Added: Further, our risk from cybersecurity threats includes failure in or breach of our operational or security systems or infrastructure managed by third-party vendors and extends to other third parties, which could disrupt our businesses, result
+Added: in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs, and/or cause losses.
+Added: While we have experienced cybersecurity incidents in the past, to date, risks from cybersecurity threats have not materially affected, nor are they reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.
For further discussion of risks from cybersecurity threats, see the section captioned “A failure in or breach of our operational or security systems or infrastructure, or those of our third-party vendors and other service providers or other third parties, including as a result of cyber-attacks, could disrupt our businesses, result in the disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses .” in Item 1A.
Risk Factors .
−Removed: Our CISO is accountable for managing our enterprise information security department and delivering our information security program.
−Removed: The responsibilities of this department include cybersecurity risk assessment, threat intelligence, control evaluation and assessment, monitoring and incident response, vulnerability assessment, third-party risk management, change management, and business resilience.
+Added: Our CISO is accountable for leading the enterprise information security department and overseeing the delivery of our information security program.
+Added: The department’s responsibilities include cybersecurity risk assessment, threat intelligence, control evaluation and testing, security monitoring and incident response, vulnerability management, and business resilience.
+Added: In addition, information security actively participates in our third‑party risk management program and the enterprise change management process.
The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function.
2 unchanged sentences
Individuals within the department are generally subject to professional education and certification requirements.
−Removed: In particular, our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.
+Added: In particular, our CISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.
Various management committees exist including the Information Security Committee, which focuses on technology risk, controls and the information security program.
This committee provides oversight and governance of the information security program and technology risks.
−Removed: This committee is chaired by the Chief Information Security Officer and includes other executives across the Bank, including the Chief Information Officer and Chief Technology Officer .
+Added: This committee is chaired by the CISO and includes other executives across the Bank, including the CIO and CTO .
This committee meets quarterly to provide oversight of information security projects and services including strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks.
−Removed: The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at the meeting and the actions taken to the Risk Committee of the Board of Directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).
+Added: The CISO reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at the meeting and the actions taken to the Risk Committee of the Board of Directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).
The Risk Committee of the Board of Directors is responsible for overseeing our information security program, including management’s actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks.
−Removed: Our Chief Information Security Officer provides quarterly reports to the Risk Committee of the Board of Directors regarding the information security program, key enterprise cybersecurity initiatives and other matters relating to cybersecurity processes.
+Added: Our CISO provides quarterly reports to the Risk Committee of the Board of Directors regarding the information security program, key enterprise cybersecurity initiatives and other matters relating to cybersecurity processes.
The Risk Committee of the Board of Directors reviews and approves our information security policies and strategies.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.