5 unchanged sentences
This program is regularly reviewed and updated to address emerging risks.
−Removed: Our process for addressing risk is based on banking industry best practices outlined in FFIEC and National Institute of Standards and Technology (“NIST”) frameworks.
+Added: Our process for addressing risk is based on banking industry best practices outlined by the FFIEC and in National Institute of Standards and Technology (“NIST”) frameworks.
We engage various third-party service providers in connection with our cybersecurity processes .
5 unchanged sentences
Our selection and oversight of these providers incorporate cybersecurity considerations, including contractual and other mechanisms to mitigate risks.
−Removed: Our third-party oversight process follows published frameworks from NIST and FFIEC to account for risks throughout the entire engagement with our third-party vendors.
+Added: Our third-party oversight process follows published best practices and frameworks from NIST and FFIEC to account for risks throughout the entire engagement with our third-party vendors.
We consistently engage in proactive measures aimed at preventing, detecting, and effectively minimizing the impact of cybersecurity incidents.
10 unchanged sentences
Accordingly, we place a high priority on mitigating risks associated with cybersecurity threats and any cybersecurity incidents.
−Removed: Our Board of Directors and Chief Executive Officer, in collaboration with our Chief Information Officer and Chief Risk Officer, oversee cybersecurity processes, risks, and threats.
+Added: Our Board of Directors and Chief Executive Officer, in collaboration with our Chief Operating Officer and Chief Risk Officer, oversee cybersecurity processes, risks, and threats.
Rather than designate one specific board committee to cybersecurity risk management, our entire Board of Directors is responsible for overseeing our risk management.
−Removed: Our Chief Risk Officer is responsible for overseeing our risk management
−Removed: generally, working closely with our internal audit department.
+Added: Our Chief Risk Officer is responsible for overseeing our risk management generally, working closely with our internal audit department.
Our Chief Risk Officer regularly reports directly to the Board of Directors with respect to all areas of risk management.
−Removed: With regard to cybersecurity specifically, we have a Chief Information Security Officer who reports to our Chief Information Officer, with a dotted-line reporting relationship to our Chief Executive Officer, and collaborates regularly with our Chief Risk Officer and Risk Team.
+Added: With regard to cybersecurity specifically, we have a Chief Information Security Officer who reports directly to our Chief Operating Officer, with a dotted-line reporting relationship to our Chief Executive Officer, and collaborates regularly with our Chief Risk Officer and Risk Team.
Our Chief Information Security Officer meets with the Chief Executive Officer on a standard cadence and chairs a committee focused on cybersecurity with monthly reports made to our Risk Committee.
7 unchanged sentences
This team of employees includes individuals with many years of prior combined work experience in cybersecurity and data protection.
−Removed: These individuals are responsible for the day-to-day implementation of our cybersecurity program, including providing immediate notice to our Chief Information Security Officer and our Chief Risk Officer of any potential cybersecurity incidents.
+Added: These individuals are responsible for the day-to-day implementation of our cybersecurity program, including providing immediate notice to our Chief Information Security Officer, Chief Operating Officer and our Chief Risk Officer of any potential cybersecurity incidents.
We employ robust and comprehensive processes to respond to cybersecurity risks.
16 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.