10 unchanged sentences
The structure of our information security program is designed to address applicable laws, regulatory guidance, and industry best practices, including Section 501 (b) of the Gramm-Leach-Bliley Act and its implementing regulations, the Federal Financial Institutions Examination Council (“FFIEC”) Information Technology Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, and the Center for Internet Security Critical Security Controls.
−Removed: In addition, we leverage certain industry and government associations, vendors, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness.
+Added: In addition, we leverage certain industry and government associations, vendors, third-party benchmarking, audits, and threat intelligence
+Added: feeds to facilitate and promote program effectiveness.
Our Chief Information Security Officer, Chief Digital & Innovation Officer, and our Chief Risk Officer, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends, issues, and emerging risks and identify best practices.
12 unchanged sentences
The Incident Management Team would leverage the expertise of team members to work together to respond to the incident and take appropriate measures.
−Removed: The Senior Risk Committee would oversee the team and receive quartelry reporting on the incident and any relevant updates.
+Added: The Senior Risk Committee would oversee the team and receive quarterly reporting on the incident and any relevant updates.
The CIRP is coordinated through Incident Management Teams that involve the Bank’s Incident Management Lead, Chief Digital & Innovation Officer, Chief Information Security Officer, and other key departments.
14 unchanged sentences
These management committees provide oversight and governance of our technology and information security programs.
−Removed: The management committees are chaired by managers within the information technology and information security departments and include the Chief Risk Officer, Chief Information Security Officer, and Chief Digital & Innovation Officer as well as their direct reports and other key departmental managers from throughout the entire company.
+Added: The management committees are chaired by managers within the information technology and information security departments and include the Chief Risk Officer, Chief Information Security
+Added: Officer, and Chief Digital & Innovation Officer as well as their direct reports and other key departmental managers from throughout the entire company.
The management committees meet at least quarterly to provide oversight of key risk management strategies, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks, especially those related to cybersecurity and technology risks.
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.