4 unchanged sentences
Information Security, in conjunction with Operations, Technology, and Executive Leadership, work together to provide and maintain security processes and procedures pursuant to which the Company will:
−Removed: • Ensure the security and confidentiality of customer and bank records covered by law.
+Added: • Ensure the security and confidentiality of client and bank records covered by law.
• Protect against any anticipated threats or hazards to the security of such records.
−Removed: • Protect against the unauthorized access or use of such records or information in ways that could result in substantial harm to the Company, our Customers, and Associates.
+Added: • Protect against the unauthorized access or use of such records or information in ways that could result in substantial harm to the Company, our Clients, and Associates.
• Establish guidelines and practices for ensuring Information Technology compliance to external and regulatory requirements.
13 unchanged sentences
Remediation efforts are organized and made available to the Risk Committee of the Board of Directors (Risk Committee) as well as for review by third party auditors and examiners.
+Added: The Company's Cybersecurity Committee is responsible for providing overall direction to reduce risk to company and Client data that resides in various systems, both in-house and with third parties.
+Added: The committee duties are to ensure the confidentiality, integrity, and availability of such information.
+Added: Further, the Cybersecurity Committee is responsible for (1) prioritization of Enterprise Strategic Planning for cybersecurity, (2) the review and approval corporate cybersecurity risk tolerance, (3) monitoring of cybersecurity threats and trends, (4) support of cross-functional collaboration on cybersecurity activities, and (5) promotion and support of cybersecurity awareness and decisions across the enterprise.
The Company has implemented a Cybersecurity Incident Response Plan (CSIRP), which is integrated into its Master Business Continuity Plan, to identify, assess and respond to cybersecurity threats.
12 unchanged sentences
The Incident Management Team structure is based on the Incident Command System and follows a flexible, adaptable approach with response team membership designed to support expanding response team needs.
−Removed: An Incident Response Task Force (IRTF) is in place to oversees the assessment of cybersecurity incidents and operational response needs.
+Added: An Incident Response Task Force (IRTF) is in place to oversee the assessment of cybersecurity incidents and operational response needs.
The CISO and the Head of Regulatory Affairs/Relations co-lead IRTF response.
1 unchanged sentence
The severity of an incident is based on perceived impacts that include the severity of damage, compromise, or loss, and probability of further exploitation or escalation.
−Removed: The Chief Information Officer (CIO) and CRO are notified of all incidents that are determined to be significant.
+Added: The Chief Information Officer (CIO) and CRO are notified of all incidents that are determined to be
based on perceived impacts of the incident or event.
3 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.