4 unchanged sentences
We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.
−Removed: Our cybersecurity risk management program includes a cybersecurity incident response plan.
−Removed: We use the Cyber Risk Institute Profile (which is based on the National Institute of Standards and Technology Cybersecurity Framework), the Federal Financial Institutions Examination Council Information Technology Examination Handbook and Cyber Assessment Tool, and the Payment Card Industry Data Security Standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business and develop and implement our cybersecurity risk management program.
+Added: Our cybersecurity risk management program includes a cybersecurity incident response standard.
+Added: We use the Cyber Risk Institute Profile (which is based on the National Institute of Standards and Technology Cybersecurity Framework), the Federal Financial Institutions Examination Council Information Technology Examination Handbook, and the Payment Card Industry Data Security Standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business and develop and implement our cybersecurity risk management program.
This does not imply that we meet any particular technical standards, specifications, or requirements.
5 unchanged sentences
• cybersecurity awareness training of employees with access to our IT systems;
−Removed: • a cybersecurity incident response plan and Crisis Management Policy that guide our response to cybersecurity incidents;
+Added: • a cybersecurity incident response standard and Crisis Management Policy that guide our response to cybersecurity incidents;
• a third-party risk identification and management process for service providers.
−Removed: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition.
−Removed: We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.
−Removed: See Part I, Item 1A.
+Added: We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, and/or financial condition.
“Risk Factors – OPERATIONAL RISKS – We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure” in this Form 10-K.
5 unchanged sentences
The Operational and Compliance Risk Committee of our Board of Directors also receives periodic reports from our CSO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents.
−Removed: 40 SLM CORPORATION — 2023 Form 10-K
Our CSO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include:
briefings from internal security personnel;
−Removed: threat intelligence and other information obtained from governmental, public, or private sources, including external cybersecurity service providers;
+Added: threat intelligence and other
+Added: 2024 Form 10-K — SLM CORPORATION 40
+Added: information obtained from governmental, public, or private sources, including external cybersecurity service providers;
and alerts and reports produced by security tools deployed in the IT environment.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.