6 unchanged sentences
As a general matter, Valley seeks to address cyber and information security risks through a cross-functional approach, as described below, that is focused on identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
−Removed: Our information security team reviews ERM-level
+Added: Our information security team reviews ERM-level cybersecurity risks annually, and key cybersecurity risks are incorporated into the ERM framework, which is periodically reviewed by management throughout the year by its Executive Risk Committee.
+Added: As part of this framework, we have a set of enterprise-wide policies and procedures concerning cybersecurity matters which go through an internal review process and are approved by appropriate members of senior management or the Board, which include an Information Security Policy, as well as other policies and procedures that directly or indirectly relate to
2025 Form 10-K
−Removed: cybersecurity risks annually, and key cybersecurity risks are incorporated into the ERM framework, which is periodically reviewed by management throughout the year at its Executive Risk Committee.
−Removed: As part of this framework, we have a set of enterprise-wide policies and procedures concerning cybersecurity matters which go through an internal review process and are approved by appropriate members of senior management or the Board, which include an Information Security Policy, as well as other policies and procedures that directly or indirectly relate to cybersecurity, and practices related to encryption, antivirus protection, remote access, multi factor authentication, the protection of confidential information and the use of the internet, social media, email, and wireless devices.
+Added: cybersecurity, and practices related to encryption, antivirus protection, remote access, multi factor authentication, the protection of confidential information and the use of the internet, social media, email, and wireless devices.
Having the appropriate governance structure in place is critical to the functioning of our cyber and information security risk framework.
4 unchanged sentences
Valley’s Chief Information Security Officer (CISO ), who is responsible for developing and implementing our cyber and information security program, has over 25 years of experience leading cyber security oversight and holds a CRISC certification, and others on our information security team have cybersecurity experience or certifications.
−Removed: The CISO and Director of Cyber Risk Management each participate in all meetings of the Cyber Subcommittee.
+Added: The CISO participates in all meetings of the Cyber Subcommittee.
Our Board, through the Risk Committee and the Cyber Subcommittee, receives regular updates and reporting from management on cyber and information security matters, including information related to third-party assessments of Valley’s information security program, as well as a wide range of topics such as recent developments, evolving standards, Valley’s vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Valley’s peers and third parties.
15 unchanged sentences
Education and Awareness .
−Removed: Valley provides mandatory cybersecurity training at least annually for all employees, which is intended to equip them with tools to identify and address cybersecurity threats, and to communicate Valley’s evolving
−Removed: 2024 Form 10-K
−Removed: information security policies, standards, processes and practices.
+Added: Valley provides mandatory cybersecurity training at least annually for all employees, which is intended to equip them with tools to identify and address cybersecurity threats, and to communicate Valley’s evolving information security policies, standards, processes and practices.
We also require employees in certain roles to complete additional role-based, specialized cyber and information security training.
1 unchanged sentence
Valley maintains incident response and recovery plans that are intended to assist in Valley’s response to a cyber or information security incident, and such plans are evaluated on a regular basis.
−Removed: In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification, including notifying functional areas (e.g., legal), as well as senior management and the Board, as appropriate.
+Added: In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification, including notifying functional areas (e.g., legal), as well as senior
+Added: 2025 Form 10-K
+Added: management and the Board, as appropriate.
As part of these plans, we have also implemented controls and procedures providing for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents, including to regulators and governmental agencies, can be made by management in a timely manner.
7 unchanged sentences
We are regularly subject to cybersecurity attacks.
−Removed: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not, to date, materially affected or are reasonably likely to affect Valley, including our business strategy, results of operations or financial condition.
+Added: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not, to date, materially affected and are not reasonably likely to materially affect Valley, including our business strategy, results of operations or financial condition.
Notwithstanding the comprehensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.
2 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.