UNRESOLVED STAFF COMMENTS
−Removed: Cybersecurity
+Added: C YBERSECURITY
Risk Management Strategy
1 unchanged sentence
Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats.
−Removed: Our Cyber Security Initiative (“CSI”) committee led by our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management organization.
+Added: Our Cyber Security Initiative (“CSI”) committee led by our Information Security Officer is primarily responsible for this cybersecurity component and is a key member of the risk management committee.
The Information Security Officer reports directly to the Managing Director of Operations and, as discussed below, regularly to the Risk and Compliance Committee of our board of directors.
2 unchanged sentences
In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness.
−Removed: Our Information Security Officer, along with key members of our risk team, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices.
−Removed: The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.
−Removed: We employe an in-depth, layered, defensive strategy that embraces a “trust by design” philosophy when designing new products, services, and technology.
+Added: Our Information Security Officer, along with key members of our risk management committee, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices.
+Added: information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.
+Added: We employ an in-depth, layered, defensive strategy that embraces a “never trust, always verify” philosophy when designing new products, services, and technology.
We leverage people, processes, and technology as part of our efforts to manage and maintain cybersecurity controls.
1 unchanged sentence
We have established processes and systems designed to mitigate cyber risk, including regular and on-going education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests.
−Removed: We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts, penetration testers, and third-party specialists .
+Added: We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts, external penetration testers, and third-party specialists .
We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain.
1 unchanged sentence
We have optimized our vulnerability management program that scans devices every four hours, and we have strict key performance metrics to ensure vulnerabilities are remediated quickly.
−Removed: We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.
+Added: We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.
We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate Board-approved management committees, as discussed further below, and the Risk and Compliance Committee of our board of directors.
5 unchanged sentences
Risk Factors.
−Removed: Our Information Security Officer is accountable for managing our enterprise information security processes and procedures and delivering our information security program.
−Removed: The responsibilities of this department include cybersecurity risk assessment, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, and business resilience .
+Added: Our Information Security Officer and Director of Information Technology is accountable for managing our enterprise information security processes and procedures and delivering our information security program.
+Added: The responsibilities of this department include cybersecurity risk assessment, incident response and business resilience, vulnerability assessment, threat intelligence, identity access governance, enterprise risk management, and third-party risk management .
The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function, and our second line of defense function, including the CSI Committee, provides guidance, oversight, monitoring, and challenge of the first line’s activities.
6 unchanged sentences
These committees are chaired by managers and experts within the Corporation and include the Chief Operating Officer, as well as his direct reports and other key departmental managers from throughout the entire company.
−Removed: These committees generally meet regularly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation to facilitate timely information and monitoring efforts.
+Added: These committees meet regularly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation to facilitate timely information and monitoring efforts.
The Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at committee meetings and the actions taken to the Risk and Compliance Committee of our board of directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.