4 unchanged sentences
Cybersecurity is a critical component of that program, especially in light of the significant, persistent, and ever-evolving cybersecurity risks facing us and other financial institutions.
−Removed: For further discussion of such risks, see the section entitled “Risk Factors” in Item 1A of this Form 10-K under the heading “Operational Risks.” Our objective is to maintain a robust cybersecurity program designed to protect the confidentiality, integrity and availability of our information systems and critical operational processes, including through identification of material information assets and systems, deployment of controls designed to protect against known cybersecurity threats, prompt detection of any cybersecurity threats that make it past our defenses, maintenance of documented, tested approaches for responding to cybersecurity threats and establishment of recovery techniques and technologies to promote resilience from any cybersecurity incidents.
+Added: For further discussion of such risks, see the section entitled “Risk Factors” in Item 1A of this Form 10-K under the heading “Operational Risks.” Our objective is to maintain a robust cybersecurity program designed to protect the confidentiality, integrity and availability of our information systems and critical operational processes , including through identification of material information assets and systems, deployment of controls designed to protect against known cybersecurity threats, prompt detection of any cybersecurity threats that make it past our
+Added: defenses, maintenance of documented, tested approaches for responding to cybersecurity threats and establishment of recovery techniques and technologies to promote resilience from any cybersecurity incidents.
As a result, the Company has developed and maintains an Information Security Program (“ISP”) and various related policies, standards, guidelines, and procedures, as a core part of its enterprise risk management program.
5 unchanged sentences
detective (such as security monitoring and event management);
−Removed: and responsive (including through business continuity plans and an enterprise-wide Cybersecurity Incident Response Program that is integrated into an overall enterprise incident response/crisis management program).
+Added: and responsive (including through business continuity plans and an enterprise-wide Cybersecurity Incident Response Program, which provides a documented framework for handling high-severity security incidents and facilitates coordination across multiple parts of the Company to manage response efforts.
+Added: The Company administers phishing tests routinely and publishes articles and alerts on its intranet regarding common attack schemes for the employees’ awareness.
+Added: Information security training is also conducted annually as continuing education for all employees.
We continually review and seek enhancements to our cybersecurity programs and processes.
2 unchanged sentences
Our ISP team monitors alerts and meets with business managers to discuss threat levels, emerging threats or trends, and available mitigation or remediation approaches and tools.
−Removed: The team also regularly collects and communicates to management relevant data
−Removed: on cybersecurity threats and risks, including through monthly cybersecurity scorecards on the status of and potential risks to key initiatives and controls, and conducts an enterprise-wide cybersecurity risk assessment at least annually.
−Removed: In addition, we obtain inputs from industry and government associations, third-party benchmarking, and threat intelligence resources and updates.
+Added: The team also regularly collects and communicates to management relevant data on cybersecurity threats and risks, including through monthly cybersecurity scorecards on the status of and potential risks to key initiatives and controls, and conducts an enterprise-wide cybersecurity risk assessment at least annually.
+Added: I n addition, we obtain inputs from industry and government associations, third-party benchmarking, and threat intelligence resources and updates.
We leverage internal auditors and third-party consultants to periodically review the processes, systems, and controls underlying our ISP and assess their design, operating efficacy, and program maturity, as well as to make recommendations to enhance their currency and effectiveness.
10 unchanged sentences
The Company’s enterprise Information Security department is primarily responsible for monitoring and managing the Company’s ISP, under the supervision of Old National’s Chief Information Security Officer (“CISO”) .
−Removed: The Information Security department’s responsibilities generally include cybersecurity risk assessment, identification and implementation of preventive measures, incident response, vulnerability assessment, threat intelligence, identity access governance, and business continuity and resilience.
+Added: Information Security department’s responsibilities generally include cybersecurity risk assessment, identification and implementation of preventive measures, incident response, vulnerability assessment, threat intelligence, identity access governance, and business continuity and resilience.
Old National has adopted an enterprise risk strategy, including for cybersecurity risks, premised on three lines of defense.
5 unchanged sentences
The Company’s CISO has extensive experience managing cybersecurity programs and assessing cybersecurity risks, with more than 30 years of experience in developing, managing, and testing information security and technology risk management programs.
−Removed: That includes over 13 years of experience in building and managing cybersecurity and technology risk programs for multi-national, Fortune 500 financial services firms, and over 10 years of experience building and managing information security consultancies specializing in cybersecurity program development and cybersecurity control
+Added: That includes over 13 years of experience in building and managing cybersecurity and technology risk programs for multi-national, Fortune 500 financial services firms, and over 10 years of experience building and managing information security consultancies specializing in cybersecurity program development and cybersecurity control testing.
He is a frequent lecturer and author on information security and technology risk topics and maintains his Certified Information Security Manager (CISM) and Certified Data Privacy Solutions Engineer (CDPSE) certifications through the Information Systems Audit and Control Association, Inc.
2 unchanged sentences
The ISTRM has direct oversight of the ISP.
−Removed: It is chaired by the CISO and meets regularly (generally monthly and no less than ten times per year) to review the ISP and related cybersecurity matters as outlined in its charter.
+Added: It is chaired by the CISO and meets regularly (generally bi-monthly and no fewer than five times per year) to review the ISP and related cybersecurity matters as outlined in its charter.
Members of the ISTRM and the other referenced management committees include the CRO, the CISO, the Chief Information Officer, key senior business operating managers and functional leaders, and other representatives from the Company’s Information Security department .
4 unchanged sentences
The Risk Committee provides a report to the full Board of Directors at each regular Board meeting regarding the Risk Committee’s risk oversight activities, including those relating to cybersecurity, and the Company maintains procedures for the CRO and/or CISO to escalate significant cybersecurity matters to the Risk Committee, Executive Committee, and/or the full Board of Directors, as appropriate.
+Added: Notwithstanding the extensive approach we take to cybersecurity, the Company continues to face risks and accompanying threats that could have a material adverse effect on the enterprise.
+Added: We work to manage these risks and
+Added: threats on a daily basis.
+Added: We continue to invest in our cybersecurity program, the resiliency of our networks, and work to enhance our internal controls.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.