10 unchanged sentences
The Company's Chief Information Security Officer (CISO) is designated as the program coordinator responsible for coordinating and overseeing the program.
−Removed: Our Information Security Department performs annual risk assessments to evaluate the effectiveness of the controls as set forth in the Information Security Program to support the requirements under Gramm-Leach Bliley Act (GLBA), and Federal Financial Institutions Examination Council (FFIEC) Guidance on Securing Customer Information.
+Added: Our Information Security Department performs annual risk assessments to evaluate the effectiveness of the controls as set forth in the Information Security Program to support the requirements under Gramm-Leach Bliley Act (GLBA), and Federal Financial Institutions Examination Council (FFIEC) Guidance on Securing Client Information.
The focus areas include:
8 unchanged sentences
Management reviews test results promptly and ensures that appropriate steps are taken to address adverse test results.
−Removed: Remediation efforts are organized and made available to the Risk Committee of the Board of Directors (Risk Committee) as well as for review by third party auditors and examiners.
+Added: Remediation efforts are organized and made available to the Risk Committee, the Audit Committee, the Cybersecurity Committee, as well as for review by third party auditors and examiners.
The Company's Cybersecurity Committee is responsible for providing overall direction to reduce risk to company and Client data that resides in various systems, both in-house and with third parties.
The committee duties are to ensure the confidentiality, integrity, and availability of such information.
−Removed: Further, the Cybersecurity Committee is responsible for (1) prioritization of Enterprise Strategic Planning for cybersecurity, (2) the review and approval corporate cybersecurity risk tolerance, (3) monitoring of cybersecurity threats and trends, (4) support of cross-functional collaboration on cybersecurity activities, and (5) promotion and support of cybersecurity awareness and decisions across the enterprise.
+Added: Further, the Cybersecurity Committee is responsible for (1) prioritization of Enterprise Strategic Planning for cybersecurity, (2) the review and approval of corporate cybersecurity risk tolerance, (3) monitoring of cybersecurity threats and trends, (4) support of cross-functional collaboration on cybersecurity activities, and (5) promotion and support of cybersecurity awareness and decisions across the enterprise.
The Company has implemented a Cybersecurity Incident Response Plan (CSIRP), which is integrated into its Master Business Continuity Plan, to identify, assess and respond to cybersecurity threats.
The CSIRP provides a well-defined, consistent, and organized approach to information security related incidents and is supplemented by playbooks designed to respond to specific attacks.
−Removed: The CSIRP requires approval by the Executive Leadership Team under the Cybersecurity Committee and is governed by the Continuity of Operations Policy that is approved annually by the Board of Directors.
+Added: The CSIRP requires approval by the Executive Leadership Team under the Management Risk Committee and is governed by the Continuity of Operations Policy that is approved annually by the Board.
The Company is not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations or financial condition.
Our Information Security Policy and Information Security Program are the standards used to protect the Bank’s confidential information.
−Removed: The Information Security Policy is annually reviewed, updated, and approved by the Risk Committee and the Board of Directors.
+Added: The Information Security Policy is annually reviewed, updated, and approved by the Risk Committee and the Board.
The CISO reports security related incidents, findings, changes, etc.
10 unchanged sentences
The severity of an incident is based on perceived impacts that include the severity of damage, compromise, or loss, and probability of further exploitation or escalation.
−Removed: The Chief Information Officer (CIO) and CRO are notified of all incidents that are determined to be
+Added: The Chief Information Officer (CIO) and CRO are notified of all incidents that are determined to be significant.
based on perceived impacts of the incident or event.
−Removed: The Chief Executive Officer and Board of Directors are notified of these incidents by the CIO and CRO as necessary.
+Added: The Chief Executive Officer and the Board are notified of these incidents by the CIO and CRO as necessary.
For further information on risks to the Company from cybersecurity threats, see " System failure or cybersecurity breaches of our network security could subject us to increased operating costs as well as litigation and other potential losses" under Item 1A.
1 unchanged sentence
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.