UNRESOLVED STAFF COMMENTS
−Removed: The Company has no unresolved staff comments from the SEC as it relates to the Company's financial information as reported in the Form 10-K.
+Added: The Company has no unresolved staff comments from the SEC as it relates to the Company's financial information as reported in this Form 10-K.
CYBERSECURITY
1 unchanged sentence
Enterprise Risk Management and Technology Risk Management.
−Removed: Within the Company's Enterprise Risk Management program, Technology Risk Management plays a pivotal role in overseeing the organization's risk posture, specifically focusing on the assessment of information and cybersecurity risks.
−Removed: Evaluated risks are subject to rigorous controls, ensuring both design and operational effectiveness and adherence to regulatory requirements.
−Removed: In instances where a risk is identified as inadequately controlled, prompt remediation measures are implemented to reduce the risk to an acceptable level.
−Removed: Identification of risks is a multifaceted process, encompassing diverse activities such as management self-disclosure, monitoring of regulatory and interagency authorities, engagement with professional and industry forums, internal and external audits, collaboration with third-party professional services, policy reviews and walkthroughs, adherence to best practice frameworks, leveraging subject matter expertise and industry experience, and maintaining a collaborative relationship with third-party service providers/vendors.
−Removed: The Technology Risk Management practice operates as a continuous model assessment, utilizing information gathered daily, weekly, monthly, and annually to provide insights into the state of controlled risk within the organization.
−Removed: Security testing and assurance activities may be outsourced to independent audit and security firms based on factors such as resource capacity, subject matter expertise, regulatory requirements, and the prevailing rate and condition of risk.
−Removed: Daily operational activities are in place to ensure the achievement and implementation of security requirements, including the management of security architecture, monitoring for potential security events or incidents, and the reporting and response to detected threats in our technology environments.
−Removed: The Information and Cyber Security Policy and Program establish policies and standards required to be implemented in support of these practices and processes.
−Removed: Additionally, we maintain a compliant and comprehensive Security Incident Response Plan, incorporating accessible resources such as insurance providers, digital and cyber forensic experts, law enforcement, along with documentation of regulatory notification.
−Removed: Our practices are interdependent with service providers/vendors, and we collaborate appropriately with these partners on notification and investigation processes to ensure complete visibility into security risks and events.
−Removed: As of the reporting period, the Company has not experienced any material cybersecurity events or incidents.
−Removed: Although third-party service providers have encountered cybersecurity events or incidents, these occurrences have not resulted in a material impact on our systems, computing environments, customers, or data.
+Added: The Company's Enterprise Risk Management program and team plays a pivotal role in overseeing the organization's risk posture, specifically focusing on the implementation of a holistic risk management program for overseeing the assessment and appropriate control of information and cybersecurity risks .
+Added: Annually, the Information and Cyber Security Policy and Program and Risk Assessments are presented for approval to the Board to ensure the program is representative and supportive of the Bank’s risk appetite and security testing expectations.
+Added: Risks identified are subject to rigorous controls, ensuring both design and operational effectiveness and adherence to regulatory requirements.
+Added: Instances where a risk is identified as inadequately controlled are promptly reported to Management requiring formal remediation activities that are tracked and reported to the Risk and Technology Committee of the Board, until measures are implemented to reduce the risk to an acceptable level
+Added: Identification of risks is a multifaceted process, encompassing diverse activities such as the execution of formal risk assessments, as described above, management self-disclosures, monitoring of regulatory and interagency authorities, engagement with professional and industry forums, internal and external audits, collaboration with third-party professional services, policy reviews and walkthroughs, adherence to best practice frameworks, leveraging subject matter expertise and industry experience, and maintaining a collaborative relationship with third party service providers/vendors .
+Added: The dedicated Technology Risk Management team operates a continuous risk management framework, utilizing information gathered daily, weekly, monthly, quarterly and annually to provide insights into the state of controlled risk within the organization.
+Added: Security testing and assurance activities are performed internally and are outsourced to independent audit and security firms based on factors such as resource capacity, subject matter expertise, regulatory requirements, and the prevailing rate and condition of risk.
+Added: Daily operational activities are in place to ensure the achievement and implementation of security requirements, including the management of the Bank’s security architecture, monitoring for potential security events or incidents, and the reporting and
+Added: response to detected threats in our technology environments.
+Added: The Information and Cyber Security Policy and Program establishes the additional policies and standards the Bank is required to implement in support of these practices and processes.
+Added: Additionally, we maintain a compliant and comprehensive Security Incident Response Plan, incorporating accessible resources such as insurance providers, digital and cyber forensic experts and law enforcement, along with documentation of regulatory notification requirements.
+Added: Our practices are interdependent with third party vendors, and we collaborate appropriately with these partners on notification and investigation processes to ensure complete visibility into security risks and events.
+Added: From time-to-time, we have identified cybersecurity threats that require us to make changes to our processes and to implement additional safeguards.
+Added: While none of these identified threats or incidents have materially affected us, it is possible that threats and incidents we identify in the future could have a material adverse effect on our business strategy, reputation, results of operations and financial condition.
+Added: During the reporting period, the Company had not experienced any material cybersecurity events or incidents.
+Added: Although third party service providers that the Bank engages have encountered cybersecurity events or incidents during the year ended December 31, 2024, the Bank’s investigation of each event or incident has shown that these occurrences have not resulted in a material impact on our systems, computing environments, customers, or data .
Board Oversight:
−Removed: The Company’s Board of Directors ("Board") provides active oversight of cybersecurity threats in accordance with the Board-approved Information and Cyber Security Policy and Program.
+Added: The Board provides active oversight of cybersecurity threats in accordance with the Board-approved Information and Cyber Security Policy and Program.
These policies and programs aim to achieve a controlled risk environment while meeting regulatory, legislative, and compliance requirements, including but not limited to the Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), Information Technology Sarbanes-Oxley Act (IT SOX) Compliance, and Payment Card Industry Data Security Standard (PCI-DSS) Compliance.
−Removed: Direct oversight of cybersecurity risks is delegated to the Board's Risk and Technology Committee.
−Removed: The Committee meets at least quarterly and receives reports detailing current risks, the maturity and functioning of associated processes and controls, and emerging or anticipated risks and threats.
−Removed: Additionally, the Risk and Technology Committee Chair provides a verbal summarized report to the full Board.
−Removed: All Committee reports are available to the full Board for review.
−Removed: In the event of critical matters arising between scheduled meetings, the Chief Risk Officer promptly notifies the Board and Risk and Technology Committee.
−Removed: To further ensure independence and effectiveness, the Board has delegated authority for the conduct of the cybersecurity program, including the referenced reports, to the Technology Risk Management Director.
−Removed: This position fulfills the role and responsibilities of a Chief Information Security Officer and reports to the Chief Risk Officer who in turn reports independently to the Chair of the Board's Risk and Technology Committee.
+Added: Direct oversight of information and cybersecurity risks is delegated to the Risk and Technology Committee of the Board.
+Added: The Risk and Technology Committee meets at least quarterly and receives reports detailing current risks, maturity and functioning of associated processes and controls, and emerging or anticipated risks and threats.
+Added: Additionally, the Risk and Technology Committee Chair provides a verbal summarized report to the full Board following each quarterly meeting, and as needed on an interim basis to address developing risk.
+Added: All Risk and Technology Committee reports are available to the full Board for review.
+Added: In the event critical matters arise between scheduled meetings, the Chief Risk Officer promptly notifies the Board and Risk and Technology Committee.
+Added: To further ensure independence and effectiveness, the Board has delegated authority for the Information and Cybersecurity Policy and Program, including the referenced reports, to the Technology Risk Management Director .
+Added: This position fulfills the role and responsibilities of a Chief Information Security Officer and reports to the Chief Risk Officer who in turn reports independently to the Chair of the Risk and Technology Committee.
Additional layers of oversight are integrated into the program through the Director of Internal Audit, who conducts independent audits of critical information technology and cybersecurity activities.
3 unchanged sentences
Management's role in assessing and managing material risks from cybersecurity threats is integral to the Company's governance framework.
−Removed: The Board-approved Information and Cyber Security Policy and Program outline specific roles and responsibilities delegated to management and the Enterprise Risk Management program, which includes Technology Risk Management.
−Removed: The Technology Risk Management Director, a seasoned information and cyber security expert with significant experience in financial institutions, oversees Technology Risk Management.
+Added: As discussed above, the Information and Cyber Security Policy and Program outline specific roles and responsibilities delegated to management and the Enterprise Risk Management Program, which includes the Technology Risk Management team, and responsibilities assigned to various employees and the Risk and Technology Committee.
+Added: The Technology Risk Management Director, a seasoned information and cyber security expert with significant experience in financial institutions, oversees the Technology Risk Management function.
This expert conducts comprehensive assessments of cybersecurity risks inherent in the industry and the Company's business activities, evaluating controls implemented to address identified risks.
9 unchanged sentences
Its purpose is to foster a security culture within the Company through active participation in planning and managing threat and security risk activities.
−Removed: All committee activities are reported to the Board's Risk and Technology Committee through committee minutes and formal activity reports provided by the Technology and Risk Management Director.
+Added: All committee activities are reported to the Risk and Technology Committee through committee minutes and formal activity reports provided by the Technology and Risk Management Director.
+Added: The Risk and Technology Committee provides similar reports to the full Board quarterly, as well as on an as-needed basis.
+Added: Results of cybersecurity-related audits are also reported to the Board's Audit and Finance Committee .
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.