5 unchanged sentences
To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.
−Removed: To prepare and respond to incidents, the Company has implemented a multi-layered “defense-in-depth” cybersecurity strategy, integrating people, technology, and processes.
+Added: To prepare and respond to incidents, the Company has implemented a multi-layered “defense-in-depth” cybersecurity strategy, integrating people, technology, and processes using leading practices and in accordance with applicable regulatory requirements.
This includes employee training, innovative technologies, and policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, and Incident Response.
−Removed: Core activities supporting the Company’s strategy include cybersecurity training, technology optimization, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.
+Added: Core activities supporting the Company’s strategy include cybersecurity training, technology optimization, security monitoring and response, identity access management, threat intelligence, vulnerability and patch management and the testing of incident response, business continuity and disaster recovery capabilities.
Employees play a significant role in the defense against cybersecurity threats.
−Removed: Every employee is responsible for protecting the Company’s and client’s information.
+Added: Every employee is responsible for protecting Company and client information.
Accordingly, employees complete formal training and acknowledge security policies annually.
−Removed: In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.
−Removed: Employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents.
−Removed: Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications.
−Removed: Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence.
−Removed: Like many other companies, the Company relies on third-party vendor solutions to support its operations;
+Added: In addition, employees are subjected to periodic simulated phishing assessments, designed to reinforce threat detection and reporting capabilities.
+Added: Employees are supported with processes and related solutions designed to identify, prevent, detect, respond to, and recover from incidents.
+Added: Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, end user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications.
+Added: Notable services include 24/7 security monitoring and response, ongoing vulnerability scanning, third-party monitoring, and threat intelligence.
+Added: Like many other financial institutions, the Company relies on third-party vendor solutions to support its operations;
many of these vendors have access to sensitive and proprietary information.
−Removed: Third-party vendors continue to be a notable source of operational
−Removed: and informational risk.
−Removed: Accordingly, the Company has implemented a Third-Party Risk Management program, which includes a detailed onboarding process and periodic reviews of vendors with access to sensitive company data.
+Added: As third-party vendors continue to be a notable source of operational and informational risk , the Company has implemented a structured Third-Party Risk Management program, which includes a defined onboarding process and periodic reviews of vendors with access to sensitive company data.
As indicated above, supporting the operations are incident response, business continuity, and disaster recovery programs.
6 unchanged sentences
Management Committee Oversight
−Removed: The Company has established an Information Technology and Security Management Committee consisting of department leaders across multiple functional areas including Data Engineering, Enterprise Applications, Strategic Planning, Technology, IT Governance, and Cybersecurity.
−Removed: These functional areas are led by qualified financial service technology professionals, with extensive certifications and advanced degrees in cybersecurity.
−Removed: Cybersecurity knowledge is expanded across all areas of Information Technology and is foundational in the approach from planning to execution.
−Removed: The committee focuses on strategic and tactical delivery, policy oversight, and the assessment and management of material risks from cybersecurity threats.
−Removed: Policies are also shared with the management Risk Committee to provide a second line review in alignment with Enterprise Risk functions.
−Removed: All Information Security activity is led by the Chief Information Security Officer , which includes developing and implementing the information security program and reporting on cybersecurity matters to the Board .
−Removed: The Chief Information Security Officer has several years of experience leading cybersecurity operations in financial services, supported by a team with various security, technical, risk, audit and leadership certifications.
−Removed: Management provides cybersecurity statistics and details to the board monthly.
+Added: The Company has established an Information Security Management and Information Technology structure consisting of department leaders across multiple functional areas including Data Engineering, Enterprise Applications, Strategic Planning, Technology, Information Technology Governance, and Cybersecurity.
+Added: These functional areas, which collaborate on a daily basis, are led by qualified financial service technology professionals, with extensive experience in their subject matter.
+Added: Cybersecurity knowledge is integrated across Information Technology, Business Units, and Operating Functions and is a key consideration in the approach from planning to execution, including when third parties are involved.
+Added: The structure enables a focus on strategic and tactical delivery, policy oversight, and the assessment and management of risks from cybersecurity threats.
+Added: Policies are also shared with the Company’s Management Risk Committee to provide a second line review in alignment with Enterprise Risk functions.
+Added: All Information Security activities are led by the Chief Information Security Officer , which includes developing and implementing the information security program and reporting on cybersecurity matters to the Company’s leadership team and the Board .
+Added: The Chief Information Security Officer has several years of experience leading cybersecurity operations in financial
+Added: services, supported by a team with various security, technical, risk, audit and program management subject matter knowledge.
+Added: Management, through the Information Security and Information Technology Governance function, provides cybersecurity statistics and details to the board monthly.
Board Committee Oversight
−Removed: The Company’s Risk and IT Board Committees provide oversight of the cyber program.
+Added: The Company’s Risk and Information Technology Board Committees provide oversight of the cyber program as part of their overall remit.
Each committee consists of Board members, chaired by an independent director.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.