3 unchanged sentences
The program is comprised of policies, guidelines, and procedures, which are intended to align with regulatory guidance, and common industry practices.
−Removed: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management process.
+Added: Assessing, identifying, mitigating, and managing cybersecurity related risks are integrated into our overall enterprise risk management process.
Cybersecurity Risk Management and Strategy
12 unchanged sentences
We require susceptible employees to take additional training and provide regular reports to management.
−Removed: We additionally maintain procedures for the safe storage and handling and secure disposal of sensitive information.
+Added: We additionally maintain procedures for safe storage and handling and secure disposal of sensitive information.
Before engaging third-party service providers, we perform due diligence in order to identify and evaluate their cyber risks.
−Removed: This process is led by the Operational Risk Management team and includes participation of dedicated information security resources.
+Added: This process is led by the Operational Risk Management team and includes participation of our Information Technology and Information Security teams.
Risk assessments are performed using Service Organization Controls (“SOC”) reports and other tools.
22 unchanged sentences
In this role, the ISO manages the Company’s information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees.
−Removed: The ISO is a member of our Corporate Operations group and reports to our Chief Risk Officer, who in turn reports to our President and CEO.
−Removed: The ISO regularly attends Risk Committee meetings to review the Company’s material cybersecurity developments and risks, and otherwise periodically provides relevant cybersecurity updates to the Risk Committee, as appropriate.
+Added: The ISO is a member of our Risk Management group and reports to our Chief Risk Officer, who in turn reports to our President and CEO.
+Added: The ISO attends Risk Committee meetings to review the Company’s material cybersecurity developments and risks, and otherwise periodically provides relevant cybersecurity updates to the Risk Committee, as appropriate.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.