What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-10 compared with 2024-03-08 · 28 added, 26 removed, 76 unchanged (42% of the section changed)

18 unchanged sentences

The TOC reviews the status of various tactical and strategic projects;

cybersecurity,

availability and performance metrics;

IT policies and IT Risk Assessment results to monitor the extent of risk, evaluate the effectiveness

of mitigating controls in place and ensure the level of risk remains within tolerance through acceptance, or further mitigation,

transfer or elimination of the risk.

technologies;

cybersecurity, availability and performance metrics;

IT and Business Continuity policies;

Business Continuity test

results and IT & Cybersecurity Risk Assessment results to monitor the extent of risk, evaluate the effectiveness of mitigating

controls in place and ensure the level of risk remains within tolerance through acceptance, or further mitigation, transfer or

elimination of the risk.

Additionally,

5 unchanged sentences

the ISO Metrics Committee is to review monthly cybersecurity metrics to support discussion of cyber threats, cyber risk trends,

and risk mitigation.

and risk mitigation as well as to participate in an annual tabletop business disruption exercise to assess the Bank’s resilience

and readiness should such an event occur.

employees participate in cybersecurity and social engineering training.

9 unchanged sentences

Oversight for the potential risks of third-party relationships lies

with the Bank’s management and the Board of Directors.

with the Bank’s management and the Board.

Bank maintains a third-party risk management oversight program to effectively assess, measure, monitor and control the risks associated

16 unchanged sentences

Results of the

audits are reported through the Bank’s Audit Committee, and ultimately to the Bank’s Board of Directors.

audits are reported through the Bank’s Audit Committee, and ultimately to the Bank’s Board.

Bank also has a relationship with a third-party Security Operations Center that provides continuous monitoring of all traffic

10 unchanged sentences

risks and results from any industry standard risk assessments parties, including any recommendations to further mitigate, transfer

or eliminate risk(s) if applicable, are reported annually to the TOC, as well as to the Board’s Finance and Risk Management

Committee, who then reports the results to the Bank’s Board of Directors.

Further, these results are included in the Board’s

annual Information Security Program Report.

or eliminate risks, if applicable, are reported annually to the TOC, as well as to the Board’s Finance and Risk Management

Committee, who then reports the results to the Bank’s Board.

Further, these results are included in the Board’s annual

Information Security Program Report.

and cybersecurity risk metrics are two of the Bank’s primary categorical risks defined in the Bank’s enterprise risk

management framework.

The Enterprise Risk Management Dashboard, which includes ongoing monitoring of technology and cybersecurity

risks, is presented to the Finance and Risk Management Committee and to the Bank’s Board of Directors on a tri-annual basis.

In addition, reports on the monitoring of third-party relationships, particularly critical relationships, are presented to the

Finance and Risk Management Committee and to the Bank’s Board of Directors.

Bank’s Board of Directors, through the Finance and Risk Management Committee, has oversight of cybersecurity incident disclosures,

if applicable.

The Enterprise Risk Management Dashboard, which includes ongoing monitoring of current and emerging technology

and cybersecurity risks, is presented to the Finance and Risk Management Committee and to the Bank’s Board on a tri-annual

In addition, reports on the monitoring of third-party relationships, particularly critical relationships, are presented

to the Finance and Risk Management Committee and to the Bank’s Board.

Bank’s Board, through the Finance and Risk Management Committee, has oversight of cybersecurity incident disclosures, if

The Finance and Risk Management Committee shall annually review with Management the Company’s Business Continuity

Plan (the “BCP”), the BCP Policy, BCP testing results and the Company’s Pandemic Plan and Cyber Incident Response

Plan and programs, including escalation protocols with respect to the prompt reporting of material cyber incidents to the Finance

and Risk Management Committee and the Bank’s Board of Directors.

The Finance and Risk Management Committee shall further

review with Management and report to the Bank’s Board of Directors any cyber incident disclosure reports to or from regulators

with respect thereto, and the root cause and remediation and enhancement efforts with respect thereto.

Plan and programs, including materiality determination criteria and escalation protocols with respect to the prompt reporting

of material cyber incidents to the Finance and Risk Management Committee and the Bank’s Board.

The Finance and Risk Management

Committee shall further review with Management and report to the Bank’s Board any cyber incident disclosure reports to or

from regulators with respect thereto, and the root cause and remediation and enhancement efforts with respect thereto.

Bank’s information technology team maintains and develops their knowledge through various business, technical and cybersecurity-related

programs, certificates and degrees, including a senior member of the team with a Master’s Degree in Business and another

team member with a Master’s Degree in Cybersecurity Management.

programs, certificates and degrees, including a senior member of the team who holds a Master of Business Administration and another

team member holding a Master’s Degree in Cybersecurity Management.

Collectively, the senior members of the information technology

team have a combined 75 years of experience in technology and cybersecurity, and the information technology team collectively

team have approximately 75 years of experience in technology and cybersecurity, and the information technology team collectively

holds and maintains continuing education in various technology and cybersecurity certification areas.

2 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments