5 unchanged sentences
to cybersecurity incidents are expected to remain high for the foreseeable future due to the rapidly evolving nature
−Removed: and sophistication of cybersecurity threats and geopolitical events, as well as due to the expanding use of Internet and mobile banking and other technology-based products and services utilized by us and our clients.
+Added: and sophistication of cybersecurity threats and geopolitical events, as well as due to the expanding use of Internet and mobile banking and other technology-based products and services utilized by us and our clients, including products and services that utilize the cloud and artificial intelligence (AI), among other emerging technologies.
To date, Key has not experienced material disruption to our operations, or material harm to our client base, from cyberattacks.
28 unchanged sentences
Privacy Compliance, which sits within Compliance Risk Management, provides advisory support, governance, and oversight of privacy-related statutes, regulations, and risks related to Key’s customers, employees, and other individuals from who Key collects personally identifiable information.
−Removed: • Third Line of Defense – Risk Review Group.
+Added: • Third Line of Defense – Risk Review Group (RRG).
The RRG reviews and evaluates the scope and breadth of security activities throughout Key and the effectiveness of the IS Program.
−Removed: RRG conducts independent internal audits on Key’s LOBs, operations, information systems, and technologies.
−Removed: These internal audits provide an independent
−Removed: perspective on Key’s processes and risks.
+Added: RRG conducts independent internal
+Added: audits on Key’s LOBs, operations, information systems, and technologies.
+Added: These internal audits provide an independent perspective on Key’s processes and risks.
Technology risks are evaluated in areas including cybersecurity and information security, data control, acquisition and development, delivery and support, business continuity, and information technology governance.
10 unchanged sentences
cybersecurity, privacy, and fraud training on an annual basis.
+Added: In addition, our management team from time to time participates in cybersecurity tabletop exercises that simulate cybersecurity incidents.
+Added: These exercises are intended to test our response to potential incidents and assess the procedures outlined in our incident response playbooks.
With respect to third party service providers, Key maintains a third party management program that is designed to
22 unchanged sentences
Key’s Deputy CISO leads the Corporate Information Security function, including the Cyber Defense Center, Identity
−Removed: & Access Management Operations, Information Security Governance, and Security Architecture and Engineering.
−Removed: The Deputy CISO has over 16 years of cybersecurity and technology risk management experience across financial
−Removed: services and retail, previously served as the Head of Information Security Governance within KeyCorp’s Corporate
−Removed: Information Security group, as well as the Head of Cybersecurity and Technology Risk Oversight within KeyCorp’s
−Removed: Risk Management group.
−Removed: He holds a bachelor’s degree in Finance and Management Information Systems and an
+Added: & Access Management Operations, Information Security Governance and Data Protection, and Security Architecture, Engineering and Platform Operations.
+Added: The Deputy CISO has over 17 years of cybersecurity and technology risk management experience across financial services and retail, previously served as the Head of Information Security Governance within KeyCorp’s Corporate Information Security group, as well as the Head of Cybersecurity and Technology Risk Oversight within KeyCorp’s Risk Management group.
+Added: He holds a bachelor’s degree in Finance and Management Information Systems and an MBA.
The CISO reports to Key’s Chief Information Officer who oversees all of Key’s shared services for technology,
46 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.