2 unchanged sentences
Cybersecurity Risk Management and Strategy
−Removed: The Company’s information security program is designed to protect sensitive information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public information, financial data, and internal operational information.
−Removed: Our Chief Information Security Officer, who reports to our Chief Risk Officer, manages our information security strategy and development within our overarching Enterprise Risk Management program.
−Removed: The Company’s cybersecurity program, including our information security policies, is designed to align with regulatory guidance and industry practices.
+Added: The Company’s information security program is designed to protect systems and sensitive information from unauthorized access, use, disclosure, alteration, or destruction, and to maintain the confidentiality, integrity, and availability of our information assets, including employee and customer non-public information, financial data, and internal operational information.
+Added: Our CISO, who reports to our CRO, manages our information security strategy and development within our overarching ERM program.
+Added: The Company recognizes the importance of maintaining a cybersecurity risk management system designed to reduce the risks that cybersecurity threats pose to financial institutions.
+Added: As a result, cybersecurity risk is managed as a key operational risk within our ERM framework.
+Added: In addition to first‑line ownership by our Information Security and Technology teams, independent second‑line risk functions, including our CISO, oversee cyber risk and control effectiveness.
+Added: Our Internal Audit function conducts periodic reviews of cybersecurity governance, risk management processes, and selected controls, and reports results to management and the Board.
+Added: The Company’s cybersecurity program, including our information security policies, is designed to align with regulatory guidance and industry practices, (e.g., NIST Cybersecurity Framework and FFIEC guidance) and is periodically assessed through independent reviews and external testing to inform control enhancements.
To protect our information systems, network, and information assets from cybersecurity threats, we use various security tools, products and processes that help identify, prevent, investigate, and remediate cybersecurity threats and security incidents.
The Company’s Information Security team monitors threat intelligence sources to research evolving threats, investigates the potential impact to financial services companies, examines company controls to detect and defend against those threats, and proactively adjusts company defenses against those threats.
−Removed: The Information Security team also actively monitors company networks and systems to detect suspicious or malicious events, including through penetration testing and periodic vulnerability scans, a managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage, and we work with leading cybersecurity companies and organizations to leverage third party technology and expertise as appropriate.
+Added: The Information Security team also actively monitors company networks and systems to detect suspicious or malicious events, including through penetration testing and periodic vulnerability scans.
+Added: Additionally, a managed security service provider supplements our efforts to provide 24 hours a day, seven days a week coverage, and we work with leading cybersecurity companies and organizations to leverage third-party technology and expertise as appropriate.
We maintain policies and procedures for the safe storage, handling and secure disposal of customer information.
3 unchanged sentences
The Company employs a number of technical controls to mitigate the risk of phishing emails targeting employees.
−Removed: We test employees monthly to determine their susceptibility to phishing test emails, and we require susceptible employees to take additional training and provide regular reports to management.
+Added: We conduct testing monthly to assess our employees susceptibility to phishing test emails, and we require susceptible employees to take additional training and provide regular reports to management.
As part of our information security program, we have adopted a Cyber Incident Response Plan (“Incident Response Plan”) which is administered by our CISO who closely coordinates with the Company’s Information Technology team.
4 unchanged sentences
Each exercise results in lessons learned and subsequent improvement to the Incident Response Plan.
+Added: We maintain cybersecurity insurance and consider risk transfer, alongside preventive and detective controls, as part of our overall approach to managing cyber risk.
The Company conducts due diligence prior to engaging third-party service providers which have access to the Company's networks, systems, and/or customer or employee data.
3 unchanged sentences
After contract execution, Seacoast requires critical and high-risk providers to have an ongoing monitoring plan.
+Added: Third-party engagements are risk-tiered at onboarding and
+Added: reassessed on a defined cadence.
+Added: Contracts for higher-risk engagements include information security obligations, incident notification requirements, and audit/assessment rights.
While we do not believe that our business strategy, results of operations or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are pervasive, and cybersecurity risk has increased in recent years.
1 unchanged sentence
We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition.
−Removed: “Risk Factors” for further discussion of the material risks associated with an interruption or breach in our information systems or infrastructure.
+Added: “Risk Factors” for further discussion of the material risks associated with an interruption or compromise of our information systems or infrastructure.
Cybersecurity Governance
Our Board of Directors is responsible for overseeing the Company’s business and affairs, including risks associated with cybersecurity threats.
−Removed: The Board oversees the Company’s corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our Information Technology Committee.
−Removed: The Enterprise Risk Management Committee of the Board has primary responsibility for overseeing the Company’s comprehensive ERM program.
+Added: The Board oversees the Company’s corporate risk governance processes primarily through its committees, and oversight of cybersecurity threats is delegated primarily to our ITC.
+Added: The ERMC of the Board has primary responsibility for overseeing the Company’s comprehensive ERM program.
The ERM program assists senior management in identifying, assessing, monitoring, and managing risk, including cybersecurity risk, in a rapidly changing environment.
3 unchanged sentences
The CISO also provides annual risk assessments and reports regarding the information security program to the full Board of Directors.
−Removed: Our CRO, in conjunction with our CISO, facilitates the involvement of the ITC in oversight of potentially significant cybersecurity incidents.
+Added: Cybersecurity risk metrics and program updates are reported to management and Board committees on a regular cadence, with periodic tabletop exercises and director education sessions supporting oversight.
+Added: Our CRO, in conjunction with our CISO, facilitate the involvement of the ITC in oversight of potentially significant cybersecurity incidents.
+Added: Potential incidents are evaluated for materiality without unreasonable delay, consistent with SEC rules.
+Added: If an incident (or series of related occurrences) is determined to be material, we disclose in a timely manner on Form 8-K Item 1.05 and provide updates as appropriate.
+Added: Management across Information Security, Technology, Operations, Legal/Compliance, Risk Management, and Corporate Audit coordinate on cybersecurity risk matters through established committees and reporting routines.
The Company’s CISO directs the company’s information security program and our information technology risk management.
6 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.