6 unchanged sentences
As a general matter, Valley seeks to address cyber and information security risks through a cross-functional approach, as described below, that is focused on identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.
−Removed: Our information security team reviews ERM-level cybersecurity risks annually, and key cybersecurity risks are incorporated into the ERM framework, which is periodically reviewed by management throughout the year at its Executive Risk Committee.
+Added: Our information security team reviews ERM-level
+Added: 2024 Form 10-K
+Added: cybersecurity risks annually, and key cybersecurity risks are incorporated into the ERM framework, which is periodically reviewed by management throughout the year at its Executive Risk Committee.
As part of this framework, we have a set of enterprise-wide policies and procedures concerning cybersecurity matters which go through an internal review process and are approved by appropriate members of senior management or the Board, which include an Information Security Policy, as well as other policies and procedures that directly or indirectly relate to cybersecurity, and practices related to encryption, antivirus protection, remote access, multi factor authentication, the protection of confidential information and the use of the internet, social media, email, and wireless devices.
3 unchanged sentences
The Risk Committee, through the Cyber Subcommittee, oversees the Company’s cybersecurity risk profile, prevalent cybersecurity risks, our enterprise information security program and key enterprise information security initiatives.
−Removed: 2023 Form 10-K
We also have a team of employees, including at the senior management level, who are dedicated to assisting the Board in fulfilling its oversight responsibility for cyber and information security.
−Removed: Valley’s Chief Information Security Officer (CISO), who is responsible for developing and implementing our cyber and information security program, has over 23 years of experience leading cyber security oversight and holds a Certified in Risk and Information Systems Controls certification, and others on our information security team have cybersecurity experience or certifications.
−Removed: The CISO and Director of Cyber Risk Management, both of whom participate in all meetings of the Cyber Subcommittee, contribute over 60 years collectively of expertise in cyber and information security across industries and at some of the world’s largest banks and at various technology firms.
+Added: Valley’s Chief Information Security Officer (CISO ), who is responsible for developing and implementing our cyber and information security program, has over 24 years of experience leading cyber security oversight and holds a CRISC certification, and others on our information security team have cybersecurity experience or certifications.
+Added: The CISO and Director of Cyber Risk Management each participate in all meetings of the Cyber Subcommittee.
Our Board, through the Risk Committee and the Cyber Subcommittee, receives regular updates and reporting from management on cyber and information security matters, including information related to third-party assessments of Valley’s information security program, as well as a wide range of topics such as recent developments, evolving standards, Valley’s vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Valley’s peers and third parties.
15 unchanged sentences
Education and Awareness .
−Removed: Valley provides mandatory cybersecurity training at least annually for all employees, which is intended to equip them with tools to identify and address cybersecurity threats, and to communicate Valley’s evolving information security policies, standards, processes and practices.
+Added: Valley provides mandatory cybersecurity training at least annually for all employees, which is intended to equip them with tools to identify and address cybersecurity threats, and to communicate Valley’s evolving
+Added: 2024 Form 10-K
+Added: information security policies, standards, processes and practices.
We also require employees in certain roles to complete additional role-based, specialized cyber and information security training.
5 unchanged sentences
While we have deployed personnel to perform testing and oversight functions internally, we also leverage external consultants and other tools to test the effectiveness of our operating environment and the protection of our data.
−Removed: We engage third parties to perform assessments on our cybersecurity measures, including information security maturity
−Removed: 2023 Form 10-K 36
−Removed: assessments, audits and reviews of our information security control environment and operating effectiveness.
+Added: We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and reviews of our information security control environment and operating effectiveness.
These assessment efforts include a wide range of activities such as tabletop exercises, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning.
8 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.