24 unchanged sentences
The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management.
−Removed: We have processes to evaluate third party service providers and vendors that have access to sensitive systems and Company and customer data, which does include the use of cybersecurity questionnaires and due diligence procedures such as assessments of that service provider’s cybersecurity posture .
+Added: The Company has recently modified its incident response plan to include mandates required under SEC Regulation S-P:
+Added: Privacy of Consumer Financial Information and Safeguarding Customer Information.
+Added: We have processes to evaluate third party service providers and vendors that have access to sensitive systems and Company and customer data, which includes the use of cybersecurity questionnaires and due diligence procedures such as assessments of that service provider’s cybersecurity posture .
Management’s Role
4 unchanged sentences
The CISO and many members of his team have multiple decades of cybersecurity related experience.
−Removed: Risk reporting is provided at monthly meetings of the firm’s cross-business Cybersecurity Committee and periodic presentations to the firm’s Risk Management Committee, at which many members of the Company’s senior management are present.
+Added: Risk reporting is provided at monthly meetings
+Added: of the Firm’s cross-business Cybersecurity Committee and periodic presentations to the Firm’s Risk Management Committee, at which many members of the Company’s senior management are present.
The CEO meets regularly with the CIO to discuss cybersecurity threats and existing and potentially new technology systems including those related to cybersecurity.
−Removed: The CIO and CISO have a standing monthly meeting with the President and General Counsel to discuss potential vulnerabilities in the cyber environment.
−Removed: The President formerly ran the Information Technology Department at the firm and as a result has significant systems experience including experience related to cybersecurity.
+Added: The CIO and CISO have a standing monthly meeting with the President/CEO and General Counsel to discuss potential vulnerabilities in the cyber environment.
+Added: The President/CEO formerly ran the Information Technology Department at the Firm and as a result has significant systems experience including experience related to cybersecurity.
Board Oversight
10 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.