5 unchanged sentences
Cybersecurity Risk Management and Strategy
+Added: Origin follows FFIEC guidance in protecting its network and information assets with industry-tested security products and processes.
+Added: Our Network and Information Security teams actively monitor company networks and systems to detect suspicious or malicious events.
+Added: The Company evaluates potential cyber risks, as appropriate, in its regular risk assessments.
+Added: Additionally, we conduct vulnerability scans, and contract with third-party vendors to perform penetration tests against the Company’s network.
+Added: The Company also engages expert cyber consultants, as necessary and appropriate.
At Origin, we expect each employee to be responsible for the security and confidentiality of client information.
7 unchanged sentences
We additionally maintain procedures for the safe storage and handling and secure disposal of sensitive information.
−Removed: Origin follows FFIEC guidance in protecting its network and information assets with industry-tested security products and processes.
−Removed: Our Network and Information Security teams actively monitor company networks and systems to detect suspicious or malicious events.
−Removed: The Company evaluates potential cyber risks, as appropriate, in its regular risk assessments.
−Removed: Additionally, we conduct vulnerability scans, and contract with third-party vendors to perform penetration tests against the Company’s network.
−Removed: The Company also engages expert cyber consultants, as necessary and appropriate.
Before engaging third-party service providers, we perform due diligence in order to identify and evaluate their cyber risks.
2 unchanged sentences
Third party service providers processing sensitive client data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cyber security threats and unauthorized access to the sensitive data.
−Removed: After contract executions, third-party service providers undergo ongoing monitoring to ensure they continue to meet their security obligations and other potential cybersecurity threats.
−Removed: As part of our information security program, we have adopted an Information and Cybersecurity Incident Response Plan (Incident Response Plan), which is primarily overseen by our Vice President, Information Security Officer (“ISO”).
+Added: After contract executions, third-party service providers undergo ongoing monitoring to ensure they continue to maintain internal controls and protocols designed to manage cybersecurity risk to systems, assets, data, and capabilities.
+Added: As part of our information security program, we have adopted an Information and Cybersecurity Incident Response Plan (Incident Response Plan), which is primarily overseen by our Senior Vice President, Information Security Officer (“ISO”).
The Incident Response Plan describes our processes and procedures for responding to cybersecurity incidents, outlining various work streams, including containment and remediation actions by information technology and security personnel, as well as operational response actions by business, communications, and risk personnel.
9 unchanged sentences
The Board oversees our corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Risk Committee.
−Removed: We created management-level Cyber Risk and Information Technology Committees to govern and oversee the information security program on a day-to-day basis.
+Added: Management also participates in Cyber Risk and Information Technology Committees used to govern and oversee the information security program.
The Risk Committee receives updates from management regarding review and assessments of cybersecurity and technology risk consistent with FFIEC guidance.
2 unchanged sentences
Additionally, we have engaged the former Chief Information Officer of a Fortune 500 global technology company to consult with our Board of Directors, management, and management-level Cyber Risk and Information Technology Committees on cybersecurity and data privacy matters.
−Removed: Our Information Security Officer (“ISO”) is responsible for the Company’s information security program.
+Added: Our ISO is responsible for the Company’s information security program.
Our ISO holds a degree in Computer Information Systems and is a graduate of Louisiana Tech University.
−Removed: He possesses over 15 years of experience in diverse technology and information security roles within the financial services sector, with four years experience in the ISO role.
+Added: He possesses over 18 years of experience in diverse technology and information security roles within the financial services sector, with five years’ experience in the ISO role.
In this role, the ISO manages the Company’s information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.