7 unchanged sentences
The members of this committee include the Company’s Chief Information Officer, Chief Compliance Officer (who is also the Information Security Officer), Chief Executive Officer, Chief Financial Officer and other critical executive management members.
−Removed: The ITSC also includes a non-voting member that is an outsourced cybersecurity expert.
−Removed: Over his 17-year career, the Company’s Chief Information Officer has served in multiple Information Technology and Cybersecurity roles, such as Senior Engineer, responsible for implementing hardened infrastructure for both physical and
−Removed: cloud applications;
+Added: The ITSC also includes a non-voting member that is an independent, outsourced cybersecurity expert.
+Added: Over his 18-year career, the Company’s Chief Information Officer has served in multiple Information Technology and Cybersecurity roles, such as Senior Engineer, responsible for implementing hardened infrastructure for both physical and cloud applications;
Solutions Architect, designing infrastructures for highly regulated industries including Financial Services, Local/State Government and Healthcare;
3 unchanged sentences
The Virtual Information Security Officer (vISO), an outsourced consultant, has an over 20-year career in Information Technology, Cybersecurity and both Internal/External Audit experience.
−Removed: He presently holds a position of Partner of Herbein, COA Advisor & Audit, where he’s held multiple positions within Information Technology and Cybersecurity.
+Added: He presently holds a position of Partner of Cherry Bekaert, formerly Herbein & Company, Inc., COA Advisor & Audit, where he’s held multiple positions within Information Technology and Cybersecurity.
The Company’s Information Technology Manager has an over 27-year career in Information Technology, the prior 14-years of which have been in Information Technology, Security and Cybersecurity, working primarily in regulated industries.
In order to ensure that cybersecurity risk management is integrated into the Company’s overall risk management plans, systems and processes, the ITSC and Chief Information Officer provide reports and updates to the Board of Directors , or a Committee thereof on a quarterly basis.
+Added: To ensure employees are properly trained, annually all employees are required to take a Gramm-Leach-Bliley Act training.
The Company’s cybersecurity risk mitigation program involves a combination of internal resources and the use of third parties.
The Company’s internal IT team performs monthly vulnerability scanning and performs an annual risk assessment based on the National Institute of Standards and Technology Cybersecurity Framework.
−Removed: The results are reported to the ITSC.
+Added: The results are reported to the ITSC, which is then reported to the Board of Directors.
The Company’s IT and compliance staff also review potential cybersecurity threats associated with the Company’s third party vendors , including performing a review of and obtaining a System of Organization Controls report from all vendors rated as “high risk” by the Company’s internal vendor management program.
3 unchanged sentences
Finally, the Company’s cybersecurity compliance program is audited by the Bank’s outsourced internal auditor.
−Removed: The Company also maintains insurance which may provide coverage for expenses and certain losses incurred in connection with a cybersecurity incident.
+Added: The Company also maintains cyber liability insurance which may provide coverage for expenses and certain losses incurred in connection with a cybersecurity incident.
Cybersecurity Incident Response Planning
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.