3 unchanged sentences
Our board of directors is actively involved in oversight of the Company’s risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM").
−Removed: The Company maintains a cybersecurity and information technology (“IT”) risk management program designed to prevent, detect and respond to information security threats, which are fully integrated into the Company’s ERM program.
+Added: The Company maintains a cybersecurity and information technology ("IT") risk management program designed to prevent, detect and respond to information security threats, which is fully integrated into the Company’s ERM program.
Our cybersecurity and IT risk management program is based on recognized frameworks established by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, as well as the banking-specific framework from the Federal Financial Institution Examination Council’s ("FFIEC’s") Cybersecurity Assessment Tool.
The Company’s program is led by our Director of Information Technology and Information Security Officer , whose teams are responsible for leading short-term and long-term enterprise-wide cybersecurity strategy, policy, standards, monitoring, architecture and processes.
−Removed: Our Director of Information Technology and Information Security Officer has over fifteen years of experience in the field of cybersecurity and over a decade of experience leading cyber security oversight in the banking industry.
+Added: Our Director of Information Technology and Information Security Officer has over fifteen years of experience in the field of cybersecurity and over a decade of experience leading cybersecurity oversight in the banking industry.
Although it is management's job to assess and manage our Company's exposure to risk, our board of directors oversees our Company's ERM, including cybersecurity and IT risks and threats, and establishes policies that govern the process.
Our board conducts much of its risk oversight activities through our Audit Committee, which works closely with our Chief Risk Officer and Internal Audit Manager.
−Removed: The Audit Committee has primary management responsibility for oversight of operations, technology and operational risk, including information security, fraud, vendor, data protections and privacy, business continuity and cybersecurity risks.
+Added: The Audit Committee has primary management responsibility for oversight of operations, technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and cybersecurity risks.
Our Audit Committee meets at least quarterly with our Chief Risk Officer, Internal Audit Manager and other members of management to assess, among other things, cyber threats or risks to align the Company for effective cybersecurity risk management and reporting.
1 unchanged sentence
Our Chief Risk Officer provides a presentation on ERM to the full board at least once annually.
−Removed: From time to time our Audit
−Removed: Committee also receives updates between meetings from our Chief Risk Officer, Chief Executive Officer, Chief Financial Officer and other members of management relating to risk oversight matters.
+Added: From time to time our Audit Committee also receives updates between meetings from our Chief Risk Officer, Chief Executive Officer, Chief Financial Officer and other members of management relating to risk oversight matters.
Security event monitoring and detection
5 unchanged sentences
We have implemented a comprehensive Incident Response Program to provide guidance in the event of a cybersecurity incident for contacting authorities and informing key stakeholders to ensure that any non-routine events are properly escalated.
−Removed: The Company participates in cybersecurity incident response exercises to test pre-planned response actions from the Company’s plan and to facilitate group discussions regarding the effectiveness of the Company’s cybersecurity incident response strategies and tactics.
−Removed: We use a third-party SEIM to provide 24x7x365 monitoring of logs, administrator and user actions, network and security appliances, and endpoint agents.
−Removed: Our Director of Information Technology and Information Security Officer actively engages with key vendors, industry participants, as well as the FS-ISAC, InfraGard, InspireCIO and SANS Internet Storm Center cybersecurity collaboration organizations .
+Added: The Company participates in cybersecurity incident response exercises to test pre-planned response actions from the Company's plan and to facilitate group discussions regarding the effectiveness of the Company’s cybersecurity incident response strategies
+Added: We use a third-party security information and event management to provide 24x7x365 monitoring of logs, administrator and user actions, network and security appliances, and endpoint agents.
+Added: Our Director of Information Technology and Information Security Officer actively engages with key vendors, industry participants, as well as other cybersecurity collaboration organizations.
Incident materiality
6 unchanged sentences
While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on the Company, risk to its systems remains significant.
−Removed: entitled Technology Risk "A successful cyber attack or other computer system breach could significantly harm the Company, its reputation and its customers".
+Added: "Risk Factors" for additional information regarding information technology risks.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.