4 unchanged sentences
While we have not encountered a cybersecurity incident that has materially impacted our operations or financial results, a security breach due to a cyber-attack in the future could result in a material impact to us, our customers, and our third-party vendors.
−Removed: The risk of such event could increase in the future due to the expansion of mobile banking and other internet-based product offerings, our use of internet-based services for internal and external purposes, acquisition and integration of new products and other offerings, increased use of third-party software solutions, and the growing reliance on mobile devices.
+Added: The risk of such event could increase in the future due to the expansion of mobile banking and other internet-based product offerings, our use of internet-based services for internal and external purposes, acquisition and integration of new products and other offerings, increased use of third-party software solutions, and the growing customer reliance on mobile devices.
Cybersecurity incidents have increased in number and severity and it is expected that these trends will continue.
−Removed: Techniques used in cyberattacks evolve frequently, are increasingly sophisticated, and may not be recognized until launched.
−Removed: Cyber-attacks can originate from a wide variety of sources, including both internal and external sources, cyber-criminals, hacktivists, groups linked to terrorist organizations or hostile countries, or third parties whose objective is to broadly disrupt the operations of
−Removed: financial institutions.
+Added: Techniques used in cyber-attacks evolve frequently, are increasingly sophisticated, and may not be recognized until launched.
+Added: Cyber-attacks can originate from a wide variety of sources, including both internal and external sources, cyber-criminals, hacktivists, groups linked to terrorist organizations or hostile countries, or third parties whose objective is to broadly disrupt the operations of financial institutions.
We may be unable to fully prevent cyber-attacks due to the inability to anticipate, detect, or recognize threats to our systems, or to implement effective preventative measures against all breaches.
8 unchanged sentences
Such consequences could include, but are not limited to:
−Removed: significant disruption of our operations and those of our customers, including losing access to important business systems;
+Added: significant disruption of our operations and those with whom we do business, including losing access to important business systems;
misappropriation of confidential information related to customers, counterparties, employees, or other parties;
20 unchanged sentences
This includes the use of preventative and detective tools to monitor, block, and alert us to suspicious activity.
−Removed: We utilize industry and regulator recognized assessment tools, such as the FFIEC Cybersecurity Assessment Tool and the Ransomware Self-Assessment Tool, to identify potential cybersecurity threats as well as the impact they could have on the Bank.
+Added: We utilize industry and regulator recognized assessment tools, such as the FFIEC Cybersecurity Assessment Tool and the Ransomware Self-Assessment Tool, to identify potential cybersecurity
+Added: Ta ble of Contents
+Added: threats as well as the impact they could have on the Bank.
Dashboards are used to track and monitor cybersecurity activity and trends.
8 unchanged sentences
Members of our IT staff have relevant training and education in computer networks and systems, information security and intelligence, and hold industry certifications related to network security, enterprise IT governance, and risk and information systems control.
−Removed: In addition, our
−Removed: employees’ network with peer banks, participate in industry groups, and attend ongoing training to stay abreast of cybersecurity threats and best practices.
+Added: In addition, our employees’ network with peer banks, participate in industry groups, and attend ongoing training to stay abreast of cybersecurity threats and best practices.
Within the Enterprise Risk Management Framework, we have established committees, both at the management and board level, to oversee risk, and ensure cybersecurity risk is escalated appropriately to the Board.
7 unchanged sentences
This includes a review of the cybersecurity dashboard which summarizes key risk indicators and identifies emerging risks.
−Removed: The Board Risk Committee provides a verbal risk report and meeting minutes to the Board at least quarterly.
−Removed: This includes a discussion of key risks and effectiveness of internal controls.
−Removed: In addition, cybersecurity incidents are escalated to the Board in a timely manner using the processes defined within the Bank’s Incident Response Plan.
+Added: The Board Risk Committee provides a verbal risk report and meeting minutes to the Board periodically.
+Added: In addition, the full Board reviews the Risk Management processes and results, and the Board's Audit Committee tracks any corrective actions identified in the Internal Audit process.
+Added: Cybersecurity incidents are escalated to the Board in a timely manner using the processes defined within the Bank’s Incident Response Plan.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.