7 unchanged sentences
BNY Mellon has implemented policies and procedures designed to detect, prevent and respond to malicious and accidental disruptions to the delivery of critical technology services.
−Removed: BNY Mellon’s cybersecurity strategy and procedures are embedded in its Three Lines of Defense model.
+Added: BNY Mellon’s cybersecurity risk management program is embedded in its three lines of defense model.
As part of its first line of defense, BNY Mellon maintains a dedicated Information Security Division (“ISD”), led by the Chief Information Security Officer (the “CISO”), that is responsible for the day-to-day management of risks from cybersecurity threats.
−Removed: ISD’s responsibilities include cyber threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats.
+Added: ISD’s responsibilities include cybersecurity threat intelligence, incident response and other cybersecurity operations aimed at enabling BNY Mellon to identify, assess and manage existing and emerging cybersecurity threats.
ISD monitors for potential threats and communicates relevant risks to the CISO and other members of executive management.
Additionally, ISD maintains a cybersecurity incident response and reporting process pursuant to which cybersecurity incidents are classified according to their severity based upon an assessment of multiple factors.
−Removed: Certain cybersecurity
−Removed: incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below.
−Removed: BNY Mellon also has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon’s cybersecurity risk management and incident response processes.
+Added: Certain cybersecurity incidents may activate enterprise-wide resiliency processes, which include, among other things, escalation through the management and Board committee structures described below.
+Added: In addition, BNY Mellon maintains a preparedness program designed to reinforce cybersecurity risk management practices and compliance with BNY Mellon’s policies and procedures.
+Added: The preparedness program includes mandatory training for all employees, contractors and consultants, enhanced training for those in roles presenting higher risk, calibrated phishing email simulations, distribution of information security awareness materials and cybersecurity event simulation exercises.
+Added: In addition, BNY Mellon leverages both internal and external assessments and engages with third-party assessors, consultants and auditors to evaluate and test its cybersecurity controls and provide guidance on potential improvements, including design and operating effectiveness.
+Added: BNY Mellon has standing arrangements with third parties to assist BNY Mellon in identifying, assessing and managing cybersecurity threats, including in connection with risk assessments, penetration testing, legal advice and other aspects of BNY Mellon’s cybersecurity risk management and incident response processes.
BNY Mellon has a defined third-party governance framework to help manage the risk posed to it by the use of third-party service providers.
BNY Mellon evaluates the risk posed by third-party service engagements based on multiple factors.
−Removed: BNY Mellon has protocols that seek to mitigate cybersecurity risks associated with third-party service providers based on the risk level assigned to such third party, which may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and/or the applicable service provider.
+Added: BNY Mellon has protocols that seek to mitigate cybersecurity risks associated with third-party service providers based on the risk level assigned to such third party, which
+Added: TABLE OF CONTENTS
+Added: may include mandatory contractual obligations or the implementation of additional controls by BNY Mellon and/or the applicable service provider.
ISD is subject to ongoing review and challenge from Technology Risk Management, which is a part of the independent second line of defense risk function.
9 unchanged sentences
The Technology Oversight Committee is chaired by the Chief Information Officer (the “CIO”) and its members include the CISO.
−Removed: BNY Mellon’s Technology Risk Committee is responsible for, among other things, overseeing and reviewing significant cybersecurity incidents.
+Added: BNY Mellon’s Technology Risk Committee is the most senior governance committee primarily focused on cybersecurity and technology risk issues and is a part of the second line of defense risk function.
+Added: It is responsible for, among other things, overseeing and reviewing emerging cybersecurity risks, significant cybersecurity incidents and remediation plans.
The Technology Risk Committee receives reports from management and has protocols for escalating certain issues and risks to the Senior Risk and Control Committee and the Risk Committee of the Board.
−Removed: The Technology Risk Committee is co-chaired by the Head of Technology Risk and Control and the Chief Technology Risk Officer, and the CISO is a member.
−Removed: BNY Mellon’s CIO, CISO and Chief Technology Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats.
+Added: The Technology Risk Committee is chaired by the interim Chief Technology Risk Officer.
+Added: Members include key leaders from the first line of defense, including the CISO.
+Added: BNY Mellon’s CIO, CISO and interim Chief Technology Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats.
BNY Mellon’s CISO joined BNY Mellon in 2022 and previously served as head of information security at a Fortune 500 biopharmaceutical company and an information technology company, as well as the Global Chief Technology Officer at a large cybersecurity company.
−Removed: BNY Mellon’s CIO has served in that position since 2017 and previously held roles as Chief Information Officer, Chief Technology Officer, and numerous other technology management positions at other large financial institutions.
−Removed: BNY Mellon’s Chief Technology Risk Officer joined BNY Mellon in 2021 and previously served as Global Head of Technology Risk Management, Chief Information Security
−Removed: TABLE OF CONTENTS
−Removed: Officer, Global Head of Cyber Risk and Operational Resilience and Chief Risk Officer for Technology and Operations at other large financial institutions.
+Added: BNY Mellon’s CIO joined BNY Mellon in September 2024 from a large multinational company, where she was responsible for overseeing information technology and cybersecurity operations.
+Added: BNY Mellon’s interim Chief Technology Risk Officer joined BNY Mellon in November 2024 and has previous experience as Global Head of Cyber, Technology and Information Security Risk Management at a global systemically important financial institution and over a decade of experience serving the U.S.
+Added: intelligence community in a variety of cybersecurity-related positions.
Reference is made to “Item 1.
1 unchanged sentence
Trustee’s Discussion and Analysis of Financial Condition and Results of Operations — Planned Development and Workover Program,” which are incorporated herein by reference.
+Added: TABLE OF CONTENTS
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.