2 unchanged sentences
Risk Management and Strategy
−Removed: We believe that our cybersecurity program provides effective protection of client information and of our operating systems from known and reasonably expected risks, while also promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology (“IT”) systems.
−Removed: In order to accomplish these goals, we maintain up-to-date information security and monitoring controls, which we believe mitigates cybersecurity risks and threats while optimizing the utility of our systems.
−Removed: At the same time, cyberattacks are increasingly common, sophisticated and destructive, and several large, highly sophisticated financial institutions have been successfully targeted in recent years, leading to significant losses of client data, denials and loss of online banking and other data services, and other critical functions that have become essential to modern banking.
−Removed: These events also have carried significant reputational risk for the successfully targeted institutions.
−Removed: In order to mitigate these risks, our Information Security Officer ("ISO") is responsible for our cybersecurity programs and for the detection of and response to any identified threats and incidents.
−Removed: That individual also reports regularly to our Board of Directors, oversees certain policies and procedures that are intended to guard against, detect, and respond to potential breaches of our IT systems.
+Added: We believe our cybersecurity program is sufficient to protect our operating systems and our databases, including those containing client information and employee information, from known and reasonably expected risks, while promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology (“IT”) systems.
+Added: We maintain up-to-date information security and monitoring controls designed to mitigates cybersecurity risks while optimizing system utility;
+Added: however, cyberattacks are becoming increasingly common, sophisticated, and destructive, and several large financial institutions have been successfully targeted in recent years, resulting in data loss, service disruptions, and reputational harms.
+Added: To mitigate these risks, our Information Security Officer ("ISO") has primary responsibility for assessing, monitoring, and managing cybersecurity risks, including the detection of and response to identified threats and incidents, and reports regularly to our Board of Directors while overseeing policies and procedures intended to guard against, detect, and respond to potential breaches of our IT systems.
+Added: The ISO has extensive cybersecurity program management experience, holds advanced academic and professional credentials, including a doctoral degree in information technology and cybersecurity and the Certified Information Systems Security Professional ("CISSP") certifications, and works jointly with the Chief Risk Officer, who chairs the Management Compliance and Risk Committee and has more than 20 years of compliance and risk management experience, to manage cybersecurity incident disclosures and related communication .
Managing Material Risks & Integrated Overall Risk Management
−Removed: We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management.
+Added: We have integrated cybersecurity risk management strategically throughout our broader risk management framework to promote a company-wide culture of cybersecurity risk management.
Our procedures and security program are the guiding policies over our cybersecurity risk management.
7 unchanged sentences
We also maintain a third party risk management program that applies to all third-party vendor relationships.
−Removed: Our Board of Directors has ultimate responsibility for providing oversight for third-party risk management and holding management accountable.
+Added: Our Board of Directors has the ultimate responsibility for providing oversight for third-party risk management and holding management accountable.
The Board provides clear guidance to regarding strategic goals and acceptable risk appetite with respect to third-party relationships.
−Removed: The Board reviews this policy on at least an annual basis to assure that we implement
−Removed: procedures and practices have been established by management.
−Removed: Our chief risk officer is responsible for development and implementation of third-party risk management policies, procedures, and practices, commensurate with the Company’s strategic goals, risk appetite and the level of risk and complexity of its third-party relationships.
−Removed: This individual regularly reports to the Board of Directors regarding third-party risk management activities.
−Removed: The Company’s internal audit staff also determines the frequency and scope of audits to examine the effectiveness of our third party risk management program.
+Added: The Board reviews this policy on at least an annual basis to assure that we implement procedures and practices have been established by management.
+Added: Our Chief Risk Officer is responsible for developing and implementing third-party risk management policies, procedures, and practices, commensurate with the Company’s strategic goals, risk appetite and the level of risk and complexity of its third-party relationships, and any potential changes in, this policy.
+Added: The Company’s internal audit also assesses and reports to the Board concerning the appropriate frequency and scope of audits to examine the effectiveness of our third-party risk management program.
The Company recognizes that not all third-party relationships present the same level of risk, and therefore not all third-party relationships require the same level, degree or type of oversight or risk management.
As part of its risk management program, management analyzes the specific risks associated with each third-party relationship, including but not limited to, cybersecurity and information security related risks.
−Removed: Risks from Cybersecurity Threats
−Removed: We have not encountered cybersecurity risks or threats that have materially impaired our business strategy, results of operations, or financial condition.
The Board recognizes the importance of managing risks associated with cybersecurity threats.
18 unchanged sentences
The ISO reports to the BRCC on the status and impact of any information security related developments and strategic initiatives, and depending on the severity of the situation, directly to the Board of Directors.
−Removed: In addition to regular meetings, the BRCC, the ISO, Chief Risk Officer, Chief Information Officer, and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution.
−Removed: T he Company’s Management Risk and Compliance Committee also reports directly to the BRCC regarding our risk management initiatives.
+Added: In addition to regular meetings, the BRCC, the ISO, Chief Risk Officer, Chief Technology Officer, and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution.
+Added: The Company’s Management Risk and Compliance Committee also reports directly to the BRCC regarding our risk management initiatives.
The BRCC also receives quarterly reports from the Executive IT Committee and IT department in order to say informed on all aspects of cybersecurity risk affecting the Company.
−Removed: Risk Management Personnel
−Removed: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the ISO, who has extensive cybersecurity program management experience working in various information security roles, including teaching as an information security instructor at a University.
−Removed: The ISO holds various information security qualifications, such as a doctoral degree in information technology and cyber security and holds the Certified Information Systems Security Professional ("CISSP") certification.
−Removed: The ISO and Chief Risk Officer are responsible for managing the disclosure and communications related to cybersecurity incidents.
−Removed: Our Chief Risk Officer chairs the Management Compliance and Risk Committee independently and has more than 20 years of experience in compliance and risk management.
Monitoring Cybersecurity Incidents
6 unchanged sentences
The Company maintains Business Continuity and Disaster Recovery plans, processes, and technology to restore systems affected by a cybersecurity incident.
−Removed: The ISO may determine that an incident has the potential to be materially relevant and would escalate that determination to the executive management, including Chief Executive Officer, Chief Risk Officer, Chief Information Officer, Chief Financial Officer, and other leaders and advisors of the Company.
+Added: The ISO may determine that an incident has the potential to be materially relevant and would escalate that determination to the executive management, including Chief Executive Officer, Chief Risk Officer, Chief Technology Officer, Chief Financial Officer, and other leaders and advisors of the Company.
In addition, we maintain insurance that we believe is customary against certain insurable cybersecurity risks.
−Removed: However, certain aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation.
−Removed: Reporting to Board of Directors
−Removed: The ISO, in his capacity as such, regularly reports to management and the BRCC on all aspects related to cybersecurity risks and incidents.
−Removed: This ensures that the highest levels of management are kept informed of our cybersecurity and the potential risks we face.
−Removed: In the event of certain cybersecurity matters which present increasing concern, our policies require escalating these cybersecurity and risk management decisions to the full Board.
+Added: However, certain
+Added: aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation.
+Added: Our principal office is located at 1000 Wilshire Blvd., Suite 500, Los Angeles, California 90017.
+Added: The Company operates twelve leased full-service branches, five leased loan production offices, and one leased administrative office, and maintains its headquarters at a leased location.
+Added: We believe our current facilities are adequate to support our operational needs.
+Added: Legal Proceedings.
+Added: In the normal course of business, we are subject to legal proceedings or claims.
+Added: Management has reviewed all legal claims against us and possible loss contingencies, and does not expect the amounts to be material to any of the Consolidated Financial Statements.
+Added: Mine Safety Disclosures.
+Added: Not applicable.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.