What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-19 compared with 2024-03-22 · 43 added, 31 removed, 50 unchanged (60% of the section changed)

11 unchanged sentences

designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services.

Mellon’s cybersecurity strategy and procedures are embedded in its Three Lines of Defense model.

BNY Mellon’s

cybersecurity risk management program is embedded in its three lines of defense model.

As part of its first line of defense, BNY Mellon

1 unchanged sentence

that is responsible for the day-to-day management of risks from cybersecurity threats.

ISD’s responsibilities include cyber threat

intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing

and emerging cybersecurity threats.

ISD monitors for potential threats and communicates relevant risks to the CISO and other members

of executive management.

Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity

incidents are classified according to their severity based upon an assessment of multiple factors.

Certain cybersecurity incidents may

activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee

structures described below.

BNY Mellon also has standing arrangements with third parties to assist BNY Mellon in identifying, assessing

and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects

of BNY Mellon’s cybersecurity risk management and incident response processes.

ISD’s responsibilities include cybersecurity

threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage

existing and emerging cybersecurity threats.

ISD monitors for potential threats and communicates relevant risks to the CISO and other

members of executive management.

Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to

which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors.

Certain cybersecurity

incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and

Board committee structures described below.

In addition, BNY Mellon maintains a preparedness program designed to reinforce cybersecurity

risk management practices and compliance with BNY Mellon’s policies and procedures.

The preparedness program includes mandatory

training for all employees, contractors and consultants, enhanced training for those in roles presenting higher risk, calibrated phishing

email simulations, distribution of information security awareness materials and cybersecurity event simulation exercises.

BNY Mellon leverages both internal and external assessments and engages with third-party assessors, consultants and auditors to evaluate

and test its cybersecurity controls and provide guidance on potential improvements, including design and operating effectiveness.

has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including

in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon’s cybersecurity risk management

and incident response processes.

BNY Mellon has a defined third-party governance

33 unchanged sentences

BNY Mellon’s Technology Risk Committee is

responsible for, among other things, overseeing and reviewing significant cybersecurity incidents.

The Technology Risk Committee receives

reports from management and has protocols for escalating certain issues and risks to the Senior Risk and Control Committee and the Risk

Committee of the Board.

The Technology Risk Committee is co-chaired by the Head of Technology Risk and Control and the Chief Technology

Risk Officer, and the CISO is a member.

BNY Mellon’s CIO, CISO and Chief Technology

Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats.

BNY Mellon’s CISO joined

BNY Mellon in 2022 and previously served as head of information security at a Fortune 500 biopharmaceutical company and an information

technology company, as well as the Global Chief Technology Officer at a large cybersecurity company.

BNY Mellon’s CIO has served

in that position since 2017 and previously held roles as Chief Information Officer, Chief Technology Officer, and numerous other technology

management positions at other large financial institutions.

BNY Mellon’s Chief Technology Risk Officer joined BNY Mellon in 2021

and previously served as Global Head of Technology Risk Management, Chief Information Security Officer, Global Head of Cyber Risk and

Operational Resilience and Chief Risk Officer for Technology and Operations at other large financial institutions.

the most senior governance committee primarily focused on cybersecurity and technology risk issues and is a part of the second line of

defense risk function.

It is responsible for, among other things, overseeing and reviewing emerging cybersecurity risks, significant cybersecurity

incidents and remediation plans.

The Technology Risk Committee receives reports from management and has protocols for escalating certain

issues and risks to the Senior Risk and Control Committee and the Risk Committee of the Board.

The Technology Risk Committee is chaired

by the interim Chief Technology Risk Officer.

Members include key leaders from the first line of defense, including the CISO.

BNY Mellon’s CIO, CISO and interim Chief

Technology Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats.

BNY Mellon’s

CISO joined BNY Mellon in 2022 and previously served as head of information security at a Fortune 500 biopharmaceutical company and an

information technology company, as well as the Global Chief Technology Officer at a large cybersecurity company.

BNY Mellon’s CIO

joined BNY Mellon in September 2024 from a large multinational company, where she was responsible for overseeing information technology

and cybersecurity operations.

BNY Mellon’s interim Chief Technology Risk Officer joined BNY Mellon in November 2024 and has

previous experience as Global Head of Cyber, Technology and Information Security Risk Management at a global systemically important financial

institution and over a decade of experience serving the U.S.

intelligence community in a variety of cybersecurity-related positions.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments