3 unchanged sentences
Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries.
−Removed: To mitigate these risks and protect sensitive customer data, financial transactions and the Company’s information systems, the Company has
−Removed: implemented a comprehensive cybersecurity risk management program , which is a component of its overarching enterprise risk management program.
+Added: To mitigate these risks and protect sensitive customer data, financial transactions and the Company’s information systems, the Company has implemented a comprehensive cybersecurity risk management program , which is a component of its overarching enterprise risk management program.
Key components of the cybersecurity risk management program include:
4 unchanged sentences
• A dedicated cybersecurity team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence.
−Removed: • A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks.
+Added: • A training program that educates employees about cybersecurity risks, how to protect themselves from cyberattacks and identify and report insider threats.
• An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online.
19 unchanged sentences
At least one member of the Risk Committee also serves as a member of the Technology Committee.
−Removed: The Risk Committee previously has received, and the Technology Committee will receive on an ongoing basis, regular updates on the Company’s cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Security Officer (“CISO”) and the Chief Security
−Removed: Officer (“CSO”).
+Added: The Risk Committee previously has received, and the Technology Committee will receive on an ongoing basis, regular updates on the Company’s cybersecurity risks and incidents and the cybersecurity program through direct interaction with the Chief Information Security Officer (“CISO”) and the Chief Security Risk Officer (“CSRO”).
The Risk Committee previously has provided, and the Technology Committee will provide on an ongoing basis, updates regarding cybersecurity risks and the cybersecurity program to the full board of directors.
6 unchanged sentences
Prior to joining the Company, the Company’s CISO served as leader of the Global Threat Management Center for a major global financial institution.
−Removed: The Information Risk department is led by the CSO, who reports directly to the Chief Risk Officer.
−Removed: The CSO is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities.
+Added: The Information Risk department is led by the CSRO, who reports directly to the Chief Risk Officer.
+Added: The CSRO is responsible for ensuring the protection of electronic and physical information through the identification and management of risk activities.
As a governance and oversight function, the Information Risk department measures and reports on the quality of information and cyber risk management across all functions of the firm.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.