6 unchanged sentences
The Company leverages the following guidelines and frameworks to develop and maintain its Information Security Program including its cybersecurity risk management program:
−Removed: Federal Financial Institutions Examination Counsel Cybersecurity Assessment Tools and GLB Act and regulations.
+Added: Federal Financial Institutions Examination Council Cybersecurity Assessment Tools and GLB Act and regulations.
In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach focused on the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cybersecurity incidents that may occur.
1 unchanged sentence
• Security Operation and Governance :
−Removed: As discussed in more detail under the section titled “Governance,” the Board Risk Oversight Committee has delegated to senior management responsibility for managing the Enterprise Risk Management Program.
+Added: As discussed in more detail under the section titled “Cybersecurity Governance,” the Board Risk Oversight Committee has delegated to senior management responsibility for managing the Enterprise Risk Management Program.
Senior management carries out this mandate through the Strategic Initiatives and Board Risk Oversight Committees.
3 unchanged sentences
• Security Competencies :
−Removed: The organization oversees a program of security competencies and tools designed to evaluate security risks and to protect the confidentiality, integrity and availability of our information systems and data.
+Added: The Company has security competencies and tools designed to evaluate security risks and to protect the confidentiality, integrity and availability of our information systems and data.
These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations).
5 unchanged sentences
• Third-Party Risk Management :
−Removed: Management of the Company’s third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven by risk factors established by the Vendor Management Program.
+Added: Management of the Company’s third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven by risk factors established by the Third-Party Risk Management Program.
The process provides awareness and collaboration across all internal teams including Information Technology and Risk Management.
2 unchanged sentences
• Security Awareness and Education :
−Removed: The Company provides annual, mandatory training for personnel regarding security awareness as a means to equip the Company’s personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company’s information security policies, standards, processes and practices.
+Added: The Company provides annual, mandatory training for personnel regarding security awareness to better equip Company personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Company’s information security policies, standards, processes and practices.
+Added: This training is supplemented with annual required third party information security training.
+Added: Additionally, the Company conducts monthly email security awareness testing, with follow-up training assigned when deemed necessary.
The Company leverages continuous monitoring and regular risks assessments to identify the Company’s current and potential cybersecurity risks.
3 unchanged sentences
Vulnerabilities identified during these assessments are inventoried in a centralized tracking system and reported to management on a regular basis.
−Removed: A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards,
−Removed: processes and practices as necessary based on the information provided by these assessments.
+Added: A multi-step approach is applied to identify, report and remediate these vulnerabilities, and the Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments.
The results of key assessments are reported in summary to the Board Risk Oversight Committee.
16 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.