8 unchanged sentences
social engineering;
−Removed: and cyberattacks by hackers, state-sponsored actors, or other malicious third parties and is compounded by the advent and availability of artificial intelligence (“AI”) tools.
+Added: and cyberattacks by hackers, state-sponsored actors, or other malicious third parties and is compounded by the advent and availability of artificial intelligence tools.
To prepare and respond to incidents, the Company has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes.
−Removed: This includes establishing a cybersecurity risk management framework that aligns with industry standards and best practices provided by the National Institute of Standards and Technology (“NIST”), employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response that ensure compliance with applicable laws, regulations and obligations, such as the Gramm-Leach-Bliley Act (“GLBA”), the Federal Financial Institutions Examination Council (“FFIEC”) Cybersecurity Assessment Tool, and the Ransomware Self-Assessment Tool (“RSAT”).
+Added: This includes establishing a cybersecurity risk management framework that aligns with industry standards and best practices provided by the National Institute of Standards and Technology, employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response that ensure compliance with applicable laws, regulations and obligations, such as the Gramm-Leach-Bliley Act, the Federal Financial Institutions Examination Council (“FFIEC”) Cybersecurity Assessment Tool, and the Ransomware Self-Assessment Tool.
Additionally, we have implemented various technical measures to prevent, detect, and respond to cybersecurity incidents, such as firewalls, third-party managed detection & response services, encryption, authentication, backup and recovery solutions.
1 unchanged sentence
The Board Enterprise Risk Management (“ERM”) Committee provides governance oversight of all risks faced by the Company, including cybersecurity and information technology general controls.
−Removed: The Chief Information Officer (“CIO”) manages the IT Department and reports to the Board Risk Committee and Chief Risk Officer (“CRO”) on these matters.
+Added: The Chief Information Officer (“CIO”) manages the IT Department and reports to the ERM and Chief Risk Officer (“CRO”) on these matters.
The CIO also supervises the Information Security Officer (“ISO”) who is responsible for implementing and maintaining the Company’s Information Security Program.
3 unchanged sentences
The Information Security Department conducts on-going technology and IT threat meetings to ensure the latest threats are addressed in addition to external and internal penetration testing, business continuity/ disaster recovery testing, and incident response plan testing.
−Removed: The CIO is a member of various management committees, chairs the Company’s management-level Information Technology Steering Committee, and presents information security and cybersecurity updates on a regular basis to the Company’s ERM Working Group, which consists of members of management, including the Chairman, President and Chief Executive Officer, Chief Operating Officer, and other senior leaders in the Company.
−Removed: The ERM Working Group is responsible for identifying and assessing cybersecurity risks, developing and implementing risk mitigation strategies that align with the Bank’s corporate strategies, and ensuring compliance with applicable laws and regulations.
−Removed: The Bank’s IT Steering Committee in conjunction with the Bank’s PMO oversees the development and implementation of our cybersecurity strategy, financial planning, and capital allocation.
−Removed: The ERM Working Group provides executive management oversight, from a risk perspective, of information systems security.
−Removed: As referenced above, the CIO provides information security updates to the ERM Working Group at each meeting.
+Added: The CIO is a member of various management committees, chairs the Company’s management-level Information Technology Steering Committee, and presents information security and cybersecurity updates on a regular basis to the Company’s Risk Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer, Chief Operating Officer, and other senior leaders in the Company.
+Added: The Risk Committee is responsible for identifying and assessing cybersecurity risks, developing and implementing risk mitigation strategies that align with the Bank’s corporate strategies, and ensuring compliance with applicable laws and regulations.
+Added: The Bank’s Information Technology (“IT”) Steering Committee in conjunction with the Bank’s Project Management Office oversees the development and implementation of our cybersecurity strategy, financial planning, and capital allocation.
+Added: The Risk Committee provides executive management oversight, from a risk perspective, of information systems security.
+Added: As referenced above, the CIO provides information security updates to the Risk Committee at each meeting.
In addition, as discussed below, the Company has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Company.
−Removed: The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the ERM Working Group.
−Removed: Cybersecurity metrics are reported to both management level committees and the ERM Committee and ERM Working Group on a quarterly basis.
+Added: The Incident Response Plan is implemented and maintained by the CIO and ISO and is subject to annual review and approval by the Risk Committee.
+Added: Cybersecurity metrics are reported to both management level committees and the ERM Committee and Risk Committee on a quarterly basis.
The Board of Directors recognizes the importance of the FFIEC for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.
44 unchanged sentences
Board Reporting.
−Removed: At least annually, the CIO reports to the Board, directly or through the Enterprise-Wide Risk Management Committee, the overall status of the Information Security Program and the Company’s compliance with the Interagency Guidelines for Safeguarding Customer Information.
+Added: At least annually, the CIO reports to the Board of Directors, directly or through the ERM Committee, the overall status of the Information Security Program and the Company’s compliance with the Interagency Guidelines for Safeguarding Customer Information.
Any material findings related to the risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management’s responses and any recommendations for program changes.
3 unchanged sentences
To ensure that information security incidents can be recovered from quickly and with the least impact to the Company and its customers, the Company maintains a structured and systematic incident response plan (the “IRP”) for all information security incidents that affect any of the IT systems, network, or data of the Company, including the Company’s data held, or IT services provided by third-party vendors or other service providers.
−Removed: The CISO is responsible for implementing and maintaining the IRP, which includes:
+Added: The CIO is responsible for implementing and maintaining the IRP, which includes:
● Identifying the incident response team (“IRT”) and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents;
2 unchanged sentences
● Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP;
−Removed: ● Reviewing the IRP at least annually, or whenever there is a material change in the Company’s business practices that may reasonably affect its cyber incident response procedures.
+Added: ● Reviewing the IRP at least annually, or whenever there is a material change in the Company’s business practices that may reasonably affect its cyber incident response procedures and
● Report up to the Executive Incident Response Committee, as needed.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.