8 unchanged sentences
The Information Security Officer has Security+ and Network+ certifications and is currently working on obtaining CISSP.
−Removed: The Company’s cybersecurity risk management is integrated as part of its overall risk management program, and the Company’s Chief Risk Officer, Information Security Officer in conjunction with Chief Information Officer work together to develop and maintain the cybersecurity program.
+Added: The Company’s cybersecurity risk management is integrated as part of its overall risk management program, and the Company’s Chief Risk Officer and Information Security Officer, in conjunction with Chief Information Officer, work together to develop and maintain the cybersecurity program.
In addition to its own employees, the Company engages third party service providers to provide security products and services as needed, using their expertise to evaluate and enhance its cybersecurity program and to inform employees regarding evolving threats, risks and defensive measures.
8 unchanged sentences
• On-going assessment of the adequacy of the cybersecurity program.
−Removed: Like many financial institutions, the Company has experienced cyber-based attacks and other attempts to compromise its information systems and expects that it will continue to experience these attacks and attempts in the future.
−Removed: In 2021, the Bank was the target of a ransomware attack in which an external actor illegally accessed and/or acquired certain data on its network.
−Removed: As a result, the Bank was sued in a purported class action lawsuit.
−Removed: The lawsuit is currently in process of settlement, subject to final court approval.
−Removed: Legal Proceedings,” above.
−Removed: While the Company has not identified other known risks from previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, like all financial institutions, the Company faces ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect its business, results of operations, or financial condition.
+Added: Like all financial institutions, the Company faces ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect its business, results of operations, or financial condition.
See Item 1A – Risk Factors – “Risk Related to our Business – System failure or breaches of our network security could subject us to increased operating costs as well as litigation and other liabilities.,” above.
2 unchanged sentences
The Company’s management, led by the Chief Risk Officer and Information Security Officer in conjunction with Chief Information Officer, is responsible for designing and implementing the program.
−Removed: The Chief Risk Officer and Information Security Officer regularly report to the Risk and Compliance Committee regarding management’s implementation of the cybersecurity program, cybersecurity risks and threat, assessments of the Company’s cybersecurity systems and the planning and status project to strength the Company’s information security.
+Added: The Chief Risk Officer and Information Security Officer regularly report to the Risk and Compliance Committee regarding management’s implementation of the cybersecurity program, cybersecurity risks and threat, assessments of the Company’s cybersecurity systems and the planning and status of projects to strength the Company’s information security.
The Company’s cybersecurity incident response plan requires that management promptly advise of the Risk and Compliance Committee of any material cybersecurity incident .
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.