3 unchanged sentences
The Company’s information security program is designed to protect sensitive information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public information, financial data, and internal operational information.
−Removed: Our Chief Information Security Officer (“CISO”) manages our information security strategy and development as overseen by our overarching Enterprise Risk Management (“ERM”) program.
+Added: Our Chief Information Security Officer, who reports to our Chief Risk Officer, manages our information security strategy and development within our overarching Enterprise Risk Management program.
The Company’s cybersecurity program, including our information security policies, is designed to align with regulatory guidance and industry practices.
1 unchanged sentence
The Company’s Information Security team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats.
−Removed: The Information Security team also actively monitors company networks and systems to detect suspicious or malicious events, including through penetration testing and routine vulnerability scans, and a managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage.
+Added: The Information Security team also actively monitors company networks and systems to detect suspicious or malicious events, including through penetration testing and periodic vulnerability scans, a managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage, and we work with leading cybersecurity companies and organizations to leverage third party technology and expertise as appropriate.
We maintain policies and procedures for the safe storage, handling and secure disposal of customer information.
6 unchanged sentences
The Incident Response Plan describes the Company’s processes, procedures, and responsibilities for responding to cybersecurity incidents, and identifies those team members responsible for assessing potential security incidents, declaring an incident, and initiating a response.
−Removed: The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Company’s Senior Leadership Team, including the Chief Executive Officer (“CEO”), Chief Financial Officer (“CFO”), Chief Risk Officer (“CRO”), Chief Legal Officer (“CLO”) and the Board of Directors.
+Added: The Incident Response Plan outlines action steps for investigating, containing, and remediating a cybersecurity incident, and includes procedures for escalation and reporting of potentially significant cybersecurity incidents to the Company’s Senior Leadership Team, including the CEO, CFO, CRO, Head of Legal, and the Board of Directors.
As necessary, the Company may retain a third-party firm to assist with forensic investigation and management of cybersecurity incidents .
12 unchanged sentences
Our Board of Directors is responsible for overseeing the Company’s business and affairs, including risks associated with cybersecurity threats.
−Removed: The Board oversees the Company’s corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Information Technology Committee (“ITC”).
−Removed: The Enterprise Risk Management Committee (“ERMC”) of the Board has primary responsibility for overseeing the Company’s comprehensive Enterprise Risk Management program.
−Removed: The Enterprise Risk Management program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment.
+Added: The Board oversees the Company’s corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Information Technology Committee.
+Added: The Enterprise Risk Management Committee of the Board has primary responsibility for overseeing the Company’s comprehensive ERM program.
+Added: The ERM program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment.
Cybersecurity matters and assessments are regularly included in both ITC and ERMC meetings.
The Board’s oversight of cybersecurity risk is supported by our CISO .
−Removed: The CISO and CIO attend ITC and ERMC meetings and provide cybersecurity updates to these Board committees.
−Removed: The CISO also provides annual risk assessments and reports regarding the information security program summary report to the full Board of Directors.
−Removed: Our CRO, in conjunction with our CISO and CIO, facilitates the involvement of the ITC in oversight of potentially significant cybersecurity incidents.
+Added: The CISO attends ITC and ERMC meetings and provides cybersecurity updates to these Board committees.
+Added: The CISO also provides annual risk assessments and reports regarding the information security program to the full Board of Directors.
+Added: Our CRO, in conjunction with our CISO, facilitates the involvement of the ITC in oversight of potentially significant cybersecurity incidents.
The Company’s CISO directs the company’s information security program and our information technology risk management.
−Removed: In this role, in addition to the responsibilities discussed above, the CISO manages the Company’s information security and day-to-day cybersecurity operations and supports the information security risk oversight responsibilities of the Board and its committees.
+Added: In this role, in addition to the responsibilities discussed above, the CISO supports the information security risk oversight responsibilities of the Board and its committees.
The CISO is also responsible for the Company’s information technology governance, risk, and compliance program and ensures that high level risks receive appropriate attention.
−Removed: Led by our CISO, the Information Security team examines risks to the Company’s information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats.
−Removed: In 2023 our CISO reported to our CIO;
−Removed: however, for 2024 the CISO will report to our CRO, who in turn reports to our CEO.
−Removed: Our CISO has cybersecurity experience spanning more than 20 years.
−Removed: Prior experience includes serving as the CISO at a mid-size regional financial institution and serving in manager roles at large professional services firms.
−Removed: He holds a degree in Computer Science and Mathematics and maintains several industry certifications.
+Added: The Information Security team examines risks to the Company’s information systems and assets, designs and implements security solutions, monitors the environment, and provides responses to threats.
+Added: Our CISO has cybersecurity and information technology experience spanning more than 30 years.
+Added: Prior experience includes serving as the CISO for a multi-national cloud hosting organization serving the legal community and several senior leadership roles in both information technology and information security at a large financial institution, Fortune 500 organizations and a large professional services firm.
+Added: The CISO holds a degree in Computer Science and maintains appropriate industry certifications.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.