1 unchanged sentence
Cybersecurity.
−Removed: All companies utilizing technology are subject to threats of breaches of their cybersecurity programs.
−Removed: In addition, as a financial services company, we are subject to extensive regulatory compliance requirements, including those established by the Federal Reserve, FDIC, RI Division of Banking and Connecticut Department of Banking.
+Added: Cybersecurity threats pose a risk to Washington Trust, as crimes committed through or involving the internet, such as phishing, hacking, denial of service attacks, stealing information, unauthorized intrusions into our internal systems or the systems of our third-party vendors could adversely impact our operations or damage our reputation.
+Added: In addition, as a financial services company, we are subject to extensive regulatory compliance requirements, including those established by the Federal Reserve, FDIC, and RI Division of Banking.
To mitigate the threat to our business and address regulatory requirements, we take a comprehensive approach to cybersecurity risk management and have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.
As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats.
+Added: We have Information Assurance and technology teams who monitor emerging threats and vulnerabilities, and remain vigilant when it comes to threat intelligence and vulnerability management.
We devote significant financial and personnel resources to implement and maintain security measures to meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure.
8 unchanged sentences
The Information Assurance team works collaboratively across the organization to develop strategies for preserving the confidentiality, integrity and availability of Corporation and customer information, identifying, preventing and mitigating cybersecurity threats, and effectively responding to cybersecurity incidents.
−Removed: We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made to management and the Audit Committee of the Board of Directors ("Audit Committee") in a timely manner.
+Added: We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and
+Added: reporting of such incidents can be made to management and the Audit Committee of the Board of Directors ("Audit Committee") in a timely manner.
Risk Assessment
At least annually, we conduct a cybersecurity risk assessment that considers information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations of our environment by third parties and consultants).
−Removed: of the assessment are used to develop plans for, and prioritization of, initiatives to enhance our security controls, and to make recommendations to improve processes.
+Added: The results of the assessment are used to develop plans for, and prioritization of, initiatives to enhance our security controls, and to make recommendations to improve processes.
Technical Safeguards
4 unchanged sentences
These plans address the prevention, detection, mitigation, and remediation of incidents, and include appropriate timely incident escalations to be followed during an incident.
+Added: In order to detect and respond to incidents in a timely manner, we have a Managed Detection and Response (“MDR”) service that continuously monitors our internal systems and alerts the our Information Assurance and technology teams of any detected anomalies or suspicious activity.
+Added: Any event/threat that is deemed dangerous to our internal systems or networks is mitigated quickly.
Third-Party Risk Management
17 unchanged sentences
The Audit Committee reports the results of their oversight function to the Board of Directors.
−Removed: The Audit Committee directly oversees our cybersecurity program and receives regular reports from management about the status of our control environment based on the CIS controls, and the prevention, detection, mitigation, and remediation of cybersecurity incidents.
−Removed: This reporting also includes information concerning material security risks and information security vulnerabilities, cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.
+Added: The Audit Committee directly oversees our cybersecurity program and receives related policies and regular reports from management about the status and effectiveness of our control environment based on the CIS controls, as well as the prevention, detection, mitigation, and remediation of cybersecurity incidents.
+Added: This reporting also includes information concerning material security risks and information security vulnerabilities, cybersecurity risk resulting from risk assessments,
+Added: progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.
Management’s Role
4 unchanged sentences
Our current CISO has served in that position since 2018 and is a 29-year employee of Washington Trust.
−Removed: He has extensive experience and expertise in information technology risk management and
−Removed: information security policies and programs.
+Added: He has extensive experience and expertise in information technology risk management and information security policies and programs.
He holds a Bachelor of Science in Computer Information Systems and several certifications, including Certified Information Systems Security Professional and Certified Information Security Auditor.
+Added: Our CISO is supported by experienced Information Assurance team members that have substantial knowledge and expertise in how to manage information security and cybersecurity risks.
+Added: These team members maintain education and certification requirements necessary to fulfill their responsibilities.
Our CTO has served in that position since 2021 and is a 14-year employee of Washington Trust.
−Removed: He has broad technical experience and expertise in information technology and holds a Bachelor of Science in Information Science and several certifications, including Cisco Certified Network Associate.
+Added: He has broad technical experience and expertise in information technology and holds a Bachelor of Science in Information Science and several certifications.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.