Institute of International Bankers

Transcription

1 Institute of International Bankers Visit us at Follow International Financial Institutions Cybersecurity Conference November 14, 2017 The Times Center, NYC 27 0

2 New York State Attorney General, under then New York State Attorney General Cuomo. There she oversaw the Bureaus of Investor Protection, Antitrust, Real Estate Finance, Consumer Frauds and Internet, leading investigations across New York State to protect investors and consumers from fraud. INTERNATIONAL FINANCIAL INSTITUTIONS CYBERSECURITY CONFERENCE THANK YOU TO OUR SPONSORS Over the course of her career, Ms. Vullo s specific legal experience has included litigations and investigations involving the financial services sectors and fraud, real estate, health care, insurance, tax, consumer protection, bankruptcy, antitrust, and constitutional law. An accomplished trial lawyer, Ms. Vullo has also argued before the U.S. Supreme Court, the U.S. Courts of Appeals for the Second, Ninth, and Tenth Circuits, and the New York State Appellate Division. Ms. Vullo is a recognized leader in protecting women s rights, including representing women raped by soldiers during the Bosnian War a case in which she secured a $745 million jury verdict for the plaintiffs. Her pro bono work also includes securing a $100 million jury verdict representing abortion providers whose lives had been threatened by an online hit list and numerous amicus curiae briefs to the U.S. Supreme Court in significant civil rights cases. Ms. Vullo was twice nominated by the New York State Commission on Judicial Nomination as a candidate for Associate Judge of the Court of Appeals. She has been named a New York Super Lawyer by Super Lawyers Magazine and has been included in numerous leading lawyer lists published by the National Law Journal and other leading publications. Ms. Vullo recently received the New York Women Making a Difference Award from Eleanor s Legacy, the Humanitarian of the Year Award from the Interfaith Nutrition Network, and the Distinguished Corporate Citizen Award from A Better Balance, among many other awards and professional recognitions. Ms. Vullo earned her J.D. from New York University School of Law, an M.P.A. from the New York University Wagner Graduate School of Public Service, and a B.A. from the College of Mount Saint Vincent. She clerked for the Hon. John A. MacKenzie, U.S. District Court, Eastern District of Virginia, following law school prior to entering private practice. 1 26

3 insolvency issues, payment systems, consumer financial services, cybersecurity/privacy issues and anti-money laundering laws. He has extensive experience counseling financial institutions, merchants, technology companies and other entities on various federal and state banking and consumer credit issues, including compliance with the Bank Holding Company Act, National Bank Act, International Banking Act, Consumer Financial Protection Act, Truth-in-Lending Act, the Fair Credit Reporting Act, the Electronic Fund Transfer Act, the Equal Credit Opportunity Act, the Fair Debt Collection Practices Act, the Real Estate Settlement Procedures Act, state unfair or deceptive acts or practices statutes, CFPB's UDAAP authority, the USA PATRIOT Act, and other anti-money laundering laws; and the creation and implementation of privacy and information security programs under Title V of the Gramm-Leach Bliley Act and state privacy laws. Jeff regularly represents banks, finance companies, trust companies and other financial service providers on regulatory matters, including the development and operation of multi-state fiduciary, deposit and lending programs. He has also advised banks, merchants, technology companies and financial services companies on issues relating to credit cards, debit cards, gift cards, virtual currency, wire transfers and ACH transactions and other mobile payment products. Jeff joined the Washington DC office of Mayer Brown in Maria Vullo, Superintendent New York State Department of Financial Services Maria T. Vullo was confirmed by the New York State Senate as Superintendent Financial Services on June 15, She was nominated for the position by Governor Andrew Cuomo. As Superintendent, she is responsible for protecting consumers and markets in New York State from fraud and financial crises, as well as reforming the regulation of financial services to keep pace with the industry s rapid evolution. Prior to joining DFS, Ms. Vullo was a litigation partner at Paul, Weiss, Rifkind, Wharton & Garrison LLP, where she led civil, criminal, and regulatory investigations before courts and governmental authorities across the country. Ms. Vullo also served as Executive Deputy Attorney General for Economic Justice Division in the Office of the 25 AGENDA Continental Breakfast Welcome and Introductory Remarks Sally Miller Morning Keynote Address: Maria Vullo 2 8:30 a.m. to 8:55 a.m. 8:55 a.m. to 9:00 a.m. Chief Executive Officer Institute of International Bankers 9:00 a.m. to 9:30 a.m. Superintendent New York State Department of Financial Services 9:30 a.m. to 10:40 a.m. NYDFS Cybersecurity Regulations and Considerations for International Financial Institutions John Rogers (moderator) CISO, Americas BNP Paribas Katherine Mooney Carroll Partner Cleary Gottlieb Steen & Hamilton LLP Richard Hudson Jaime Kahan Jeffrey Taft Coffee Break Sponsored by VP of Cybersecurity & Data Protection Cordium Principal Ernst & Young LLP Partner Mayer Brown LLP 10:40 a.m. to 11:00 a.m.

4 The Federal Perspective on Regulating Cyber Security Paul Begey (moderator) Patrick Kelly Arthur Lindo Jared Sawyer Networking Lunch 11:00 a.m. to 12:00 p.m. Director of Government Relations Institute of International Bankers Acting Director for Critical Infrastructure Office of the Comptroller of the Currency Senior Associate Director Federal Reserve Board Deputy Assistant Secretary, U.S. Department of the Treasury 12:00 noon to 1:00 p.m. 1:00 p.m. to 1:55 p.m. Do s and Don ts of Information Sharing and Cyber Incident Response Michael Leiter (moderator) Luke Dembosky Partner Skadden, Arps, Slate, Meagher & Flom LLP Partner Debevoise & Plimpton LLP outsourcing projects, investment operations outsourcing projects, technology development projects, strategic alliances, and licensing and services agreements. He has significant experience advising on the renegotiation and exit from these arrangements and on disputes in the sector. Mr. Smith also has advised on the technology aspects of numerous private equity and restructuring matters, often supporting client efforts to rationalize their technology strategy and operations in connection with M&A transactions, investments, and restructurings. EXPERIENCE -Corporate Data Privacy and Information Security -Data Privacy and Information Security FinTech Mergers and Acquisitions -Outsourcing Biotechnology Technology United States His recent representations include advising: A major global bank on the establishment of a financial industry utility services offering; A major global bank on the transformation of its data storage strategy and operations;; A global pharmaceutical company on a number of IT outsourcing and BPO transactions; A number of major companies on disputes and renegotiations of existing technology services agreements; Numerous strategic alliances, including many structured to address cross-border or industry regulation limitations; and; A wide range of reorganizations of company operations and technology in connection with corporate restructuring and bankruptcy matters. In addition to his experience in the United States, Mr. Smith has led Milbank teams onsite in Europe and Asia. Recognition & Accomplishments Mr. Smith has been recognized as an outstanding US practitioner in Legal 500. Richard Livesley Perry Menezes Director, Canadian Programs FS-ISAC Managing Director KPMG LLP 3 EDUCATION: University of Michigan, J.D. University of Iowa, B.A. ADMISSIONS: New York Jeffrey Taft, Partner Mayer Brown LLP Jeffrey Taft is a financial services regulatory attorney whose practice focuses primarily on bank regulation, bank receivership and 24

5 financial protection, and financial technology. During the 114th Congress, Mr. Sawyer served as Designee and lead policy advisor for Chairman Randy Neugebauer (R-TX) on the Subcommittee on Financial Institutions and Consumer Credit in the House Financial Services Committee. Prior to his public service, Mr. Sawyer served as a legislative analyst at Citigroup in Washington, D.C. He holds a B.A in Liberal Studies from Holy Cross College, and a J.D. from the University of Louisville, Brandeis School of Law. Juli Smith, Director Barclays Juli Smith, a Director at Barclays, is a senior member of Barclays' Operations, Technology & Commercial Legal team. Juli represents the Barclays Group worldwide with respect to technology transactions, outsourcing/vendor management, cybersecurity, market data, critical infrastructure functions, and the protection and commercialization of Barclays' intellectual property. She serves as Barclays' primary internal lawyer on U.S. Cyber Export Laws, and is part of Barclays core U.S. Legal Technology Incident Response Team. Juli has been responsible for cyber issues as an in-house lawyer for over 15 years. She served as Assistant General Counsel at AIG from , in the e-commerce legal group. Prior to AIG, Juli was a corporate associate at Latham & Watkins. She received her JD from Columbia Law School, an MPA from Columbia School of International and Public Affairs, and a BA from Brown University. Nicholas Smith, Partner Milbank, Tweed, Hadley & McCloy LLP Nicholas is a partner in the firm s Technology Practice. He advises a wide range of clients on all types of complex technology projects including: outsourcing transactions; IP licensing; cloud services; strategic alliances and collaborations; and technology development and innovation projects. Nicholas also has considerable experience in renegotiations and dispute management in this area. He has been a featured speaker at a number of national conferences on topics ranging from vendor management regulation to innovation strategy. Primary Focus & Experience Mr. Smith focuses mainly on advising companies on complex commercial transactions, including IT and business process :55 p.m. 2:50 p.m. Third-Party Risk Management: Protecting Your Institution from Your Vendors Juli Smith (moderator) David Everest Nicholas Smith Namrta Moudgil & Bradley Mervis Coffee Break Sponsored by Director Barclays Senior Manager Treliant Risk Advisors Partner Milbank, Tweed, Hadley & McCloy LLP Manager Senior Manager Deloitte The Convergence of Operations Risk and Cyber Risk Mark Dreszler (moderator) Yusuf Hussain Richard Moore Evan Sekeris 2:50 p.m. to 3:10 p.m. 3:10 p.m. 4:05 p.m. Sr. Director, Cyber & Tech. Risk Mgmt. US IHC & Global Capital Markets Royal Bank of Canada Director, Information Risk Management MUFG Union Bank, N.A. Managing Director Alvarez & Marsal, FIAS Partner Oliver Wyman

6 4:05 p.m. 5:00 p.m. Emerging Issues and Other Complex Concerns for Internationally Active Financial Institutions David Homovich (moderator) Information Security Manager Credit Suisse Greg Crouse James Fox Aristedes Mahairas Adjournment Managing Director Navigant Cybersecurity and Privacy Assurance Leader PwC Special Agent in Charge, Special Operations / Cyber Division - Federal Bureau of Investigation (FBI) 5:00 p.m. Some of his recent client engagements include: For a foreign global bank, helped them develop a comprehensive operational risk framework for their US based IHC. Ensured both integration of the framework in their international framework as well as US regulatory compliance. For a large internationally active US bank: supported major change of course in CCAR operational risk stress estimates a few months prior to submission in reaction to regulatory guidance. For a large regional bank: built their CCAR loss projection model and wrote the documentation for the full CCAR operational risk submission. For a global bank conducted a validation of their operational risk modeling framework for CCAR Prior to joining Oliver Wyman, Evan was the Head of Risk Consulting for Financial Institutions for Aon in Columbia, Maryland. He was in charge of building Aon s risk consulting practice for financial institutions and managed multiple teams based in North America and Europe to deliver services to clients worldwide. Previously, Evan was an Assistant Vice President of the Federal Reserve Bank of Richmond, where he created the center of excellence for operational risk which served the System needs for operational risk related matters. The team was in charge of the supervision of all AMA and CCAR banks in the US and developed the Fed s CCAR model for operational risk. Evan earned a B.A. and M.A. in Economics from the Université Catholique de Louvain in Belgium. He received an additional M.A. as well as his Ph.D. in Economics from the University of California at Los Angeles. Jared Sawyer, Deputy Assistant Secretary U.S. Department of the Treasury 5 Jared Sawyer serves as Deputy Assistant Secretary for Financial Institutions Policy at the U.S. Department of Treasury. In this capacity, Mr. Sawyer is responsible for policy development and management of programs related to financial institutions, insurance, and cybersecurity. Prior to joining the Treasury Department, Mr. Sawyer served as Senior Counsel to Chairman Mike Crapo (R-ID) on the Senate Committee on Banking, Housing & Urban Affairs, where he managed issues related to prudential regulation, consumer 22

7 As part of setting up third party programs, she has been involved in development and deployment of third party risk tiering methodologies, as well as various risk and control assessment practices including performance monitoring, customer complaints processes, exit strategies, and information security assessments. She has also worked extensively in driving compliance programs based on regulatory requirements and industry standards. Additionally, she has managed third party assessment programs for global clients for over 100 third party assessments annually. John Rogers, CISO, Americas BNP Paribas John Rogers is the Chief Information Security Officer (CISO) for BNP Paribas USA, the Intermediate Holding Company, as well as for CIB Americas and Investment Partners North America. Prior to joining BNP Paribas, John Rogers was a Principal - Director at Booz Allen Hamilton, where he led the firm s Commercial Cyber Strategy and Privacy practices. Before assuming that position he served as the firm s Chief Technologist. Prior to joining Booz Allen Hamilton, John worked with Protiviti as an Information Security & Privacy Manager, managing security and privacy projects for multiple clients, and with Bank of America as an Information Security specialist, leading security reviews of acquired companies and performing security risk assessments of critical areas of the Bank s network. He is widely published in the area of cyber and information security and is active in the Information Systems Securities Association. Evan Sekeris, Partner Oliver Wyman Evan G. Sekeris is a Partner in the Financial Services practice of Oliver Wyman, based in Washington, D.C. His areas of focus are operational risk, stress testing and model risk management. Evan s background is in the measurement and quantification of credit risk and operational risk. His primary focus is currently on supporting institutions in building operational risk modeling for stress testing, developing their risk identification process and developing their model risk management frameworks. 21 Speaker Bios Paul Begey, Director of Government Relations, Institute of International Bankers Paul Begey is the Director of Government Relations for the Institute of International Bankers. For nearly 20 years, he has worked in and with government, including over 8 years on Capitol Hill, and has focused his career on financial services and technology policy. Prior to joining IIB, he spent several years at the Financial Services Roundtable. Paul earned his MBA from the Robert H. Smith School of Business, University of Maryland, and holds two undergraduate degrees from the University of Maryland, College Park. Greg Crouse, Managing Director Navigant Greg Crouse is a Managing Director in the Banking, Insurance & Capital Markets practice at Navigant. Greg has over 25 years of Technology consulting experience in Banking, Investment Management, and Insurance, with deep expertise in payments, technology and business alignment, and operational performance and transformation. Greg has managed key strategic and operational initiatives on several complex integrations for large, multi-national institutions; many engagements have been in excess of $100MM. Greg s extensive experience integrating business operations with technology are complimented by a deep understanding of very large Financial Services, as well as enterprise resource planning (ERP) systems. This experience has allowed Greg to troubleshoot and correct some of the largest systems implementations in the world, and he has been called upon as an expert witness on several very large systems implementation matters. Greg has led large, cross-functional, high-performing teams by setting clear strategic vision and solving complex problems in fast-paced and ambiguous environments. Work History 6

8 Managing Director, Financial Services Technology Lead, Navigant Banking Technology Lead, KPMG Managing Dir., Financial Services Technology Lead, Dell/Perot Systems Director, Bearing Point Director, Accenture Education Bachelor of Business Administration University of Texas at Austin. Luke Dembosky, Partner Debevoise & Plimpton LLP Luke Dembosky is co-chair of the global Cybersecurity & Data Privacy practice at Debevoise & Plimpton, LLP. His practice focuses on cybersecurity incident preparation and response, related civil litigation and regulatory defense, as well as national security issues. Mr. Dembosky joined Debevoise in March 2016 after serving as Deputy Assistant Attorney General for National Security at the Justice Department, where he oversaw DOJ s first national security cyber portfolio. Over a 14-year career, he led the Department s work on many landmark cyber cases, including as the senior DOJ official on the Target, Sony Pictures, Home Depot, Anthem and OPM breaches, among many others, and oversaw global operations such as the GameOver Zeus botnet takedown, for which he received the Attorney General s Distinguished Service Award. Mr. Dembosky has been a regular advisor to the senior leadership of the DOJ, FBI, Secret Service, National Security Council and other agencies regarding significant cyber cases and related legal and national policy issues. He participated directly in the negotiation of a 2013 cyber accord with Russia and the historic 5-point agreement signed by President Obama and President Xi Jinping of China in 2015, and has co-represented DOJ in cyber discussions at the United Nations. Prior to serving as Deputy Assistant AG, Mr. Dembosky was Deputy Chief for Litigation at DOJ s Computer Crime and Intellectual Property Section, where he managed all cyber prosecutions by the section s 35 attorneys. From fall 2010 to spring 2013, he served as DOJ s representative at the U.S. Embassy in Moscow, Russia, where he represented the U.S. before senior Russian officials on a range of cyber matters. From 2002 to 2010, Mr. Dembosky was a federal cybercrime prosecutor in Pittsburgh, where his prosecutions included 7 Prior to joining A&M, Mr. Moore served as the Chief Information Security Officer at New York Life Insurance Company. In this role, he implemented an agile and transformational Information security program that fostered an integrated "Intelligence and Risk" culture and program, providing executive management with a business focused view of the company's cyber risks landscape. As part of the "Intelligence and Risk" program, he was responsible for leading and collaborating with a group of cross functional executives in enhancing the company's overall cyber risk management capabilities encompassing information security, physical security, vendor risk management, cyber incident response, threat intelligence, regulatory technology and security compliance, operational risk management as well as a world-class crisis and business resiliency programs. He was responsible for leading complex technical and operational mitigation efforts associated with the company's threat landscape and regulatory matters. Mr. Moore has served on numerous industry and client advisory boards, and has been an Adjunct Professor at Salve Regina University and a Staff Lecturer at Northeastern University Graduate Information Assurance programs. In addition to his University lectures, Mr. Moore is frequently a featured speaker at numerous industry conferences. He is a contributing author of the Computer Security Handbook versions 5 & 6. Mr. Moore earned a masters in information assurance from Norwich University. Additionally, he has held numerous industry certifications during his career, and has actively maintained his Certified Information Systems Security Professional and Certified Information Security Manager designations. Namrta Moudgil, Manager Deloitte Namrta Moudgil has been working with Deloitte & Touche since June 2009 and has an overall experience of 13 years. During this time, she has been primarily associated with third party and cyber risk management related engagements for large financial services clients. As part of her engagements, she has led design and development of enterprise-wide third party risk management programs for a number of large FSI clients, including program strategy, policies, governance and operating models for oversight for suppliers and Inter-affiliates. 20

9 requirements and the development of U.S. resolution plans or living wills. She also advises financial institutions in investigations and enforcement matters involving U.S. federal banking agencies, the Office of Foreign Assets Control and U.S. congressional committees. Katherine joined the firm in 2001 and became partner in 2012; she left the firm to serve in the Defense Department in 2016 and returned as a partner in She worked in the firm s Hong Kong and New York offices before moving to the Washington office in Prior to studying law, Katherine worked as the executive director of the Open Society Institute in Uzbekistan and as the special assistant to the assistant secretary of defense for international security policy at the U.S. Department of Defense. Education: -Yale Law School, J.D., Harvard College, A.B., magna cum laude, 1992 Bar Admissions: -District of Columbia -New York Richard Moore III, Managing Director Alvarez & Marsal, FIAS Richard Moore is a Managing Director with Alvarez & Marsal's Financial Industry Advisory Services located in New York, where he specializes in cyber risk. Mr. Moore brings over 25 years of experience designing, leading, and maintaining the implementation and assurance frameworks for organizational information. Mr. Moore began his career developing the foundation of his operational and technical skills during his 15 years of military service with the U.S. Marine Corps Intelligence Community, concluding his military service as the Regimental Intelligence Chief, where he had the opportunity to provide military intelligence briefings two US Presidents and many senior cabinet and military leaders. He continued his passion for protecting information and creating sound cyber risk practices when he transitioned to the private sector, as a consultant with KPMG providing security services for various public, private, and governmental institutions and subsequently assumed a senior leadership role with the Royal Bank of Scotland - Citizens Bank leading the institution's regulatory and data protection programs. 19 U.S. v. Max Ray Vision, featured in the books Kingpin and DarkMarket and the first episode of American Greed to cover a cyber case. Mr. Dembosky s recent cybersecurity matters include managing response to one of the largest corporate data breaches in history, assisting critical infrastructure clients with national security cyber threats, leading data breach litigation for a major financial institution, and assisting a wide range of the firm s clients in preparing for and managing cyber risks. He is recognized in the U.S. and abroad as a leader on cybersecurity issues, and was named by the National Law Journal to its 2016 list of Cyber Security Trailblazers. Mr. Dembosky is a member of the newly established International Bar Association Cybersecurity Task Force and is Vice Chair of the Cybersecurity, Privacy and Data Protection Committee of the ABA s Public Contracts Law Section. Mark Dreszler, Sr. Dir., Cyber & Tech. Risk Mgmt. US IHC & Global Capital Markets, Royal Bank of Canada Mark is a Senior Director at the Royal Bank of Canada. His primary responsibility is governance and oversight of Cyber and Technology Risk Management for the US IHC and Global Capital Markets. He is also responsible for all regulatory engagements in the US. Experienced in establishing IT Risk Frameworks across diverse global business units and communicating governance processes to senior business management, Mark has held senior management positions at Credit-Suisse, JP Morgan, Citigroup and Arthur Andersen. Certifications include CISA, CRISC and the FINRA Series 99 license. David Everest, Senior Manager Treliant Risk Advisors David Everest is a Senior Manager with Treliant Risk Advisors. He is an experienced professional specializing in process improvements, third-party oversight program development, information security, model risk, and operational risk. At Treliant, David has led and contributed to various engagements in areas such as operational risk, compliance program development, information security and data risk, financial product controls, data 8

10 extraction and transformation, and third-party risk. He has also contributed to engagements at Top 20 financial institutions involving Bank Secrecy Act/Anti-Money Laundering (BSA/AML) and mortgage compliance reviews and lookbacks, as well as global financial crimes compliance. David has provided comprehensive support and analysis of a Top 20 bank s third-party oversight program, including its pre-contract reviews and ongoing oversight, resulting in improved policies, procedures, and internal controls. He is proficient with internal policies and procedures for domestic and international financial institutions. In addition, he has participated in the review of a New York-based international financial institution s BSA/AML program, helping to bring its policies, procedures, and internal controls in compliance with the Board of Governors of the Federal Reserve System and the New York State Department of Financial Services (NYDFS). Prior to joining Treliant, David worked with a Top 20 financial institution, with responsibility for finance product control, accounting, and financial reporting for various transactions to management. He also was a Payment Card Industry (PCI) Manager and developed a corporate-wide PCI compliance program, led PCI Data Security Standard (DSS) audits, and oversaw the development of policies and procedures. In addition, he worked as an internal consultant on several major projects, including data center relocation and outsourcing initiatives. David has owned and operated several successful small businesses in his community. David earned an MBA from the Weatherhead School of Management at Case Western Reserve University and a BS from Baldwin Wallace University. He is a Certified Information Systems Security Professional (CISSP), a Certified Information Systems Auditor (CISA), and a member of the advisory board for the New Tech East High School in Cleveland, Ohio. James Fox, Cybersecurity and Privacy Assurance Leader PwC James has over 20 years of consulting and technology leadership in firms such as PwC, McKinsey & Co., Booz Allen Hamilton and KPMG (UK) and the venture firm New Enterprise Associates (EIR). 9 banks contribute significantly to the U.S. economy and to the depth, liquidity and vitality of the U.S. financial markets. Prior to joining the IIB on November 1, 2010, Sally was a Senior Vice President at the American Bankers Association charged with the responsibility for assisting member banks with legislation, regulations and other issues involving securities, trusts and investments. Sally also served as Executive Director and General Counsel for the ABA Securities Association ( ABASA ) and in that capacity focused on investment banking, derivatives and other similar bank capital markets activities. In August 2011, Sally completed a three-year term as Chair of the American Bar Association s Banking Law Committee. Previously, she had served as Vice-chair of the Committee and Chair of its Securities Subcommittee. Prior to going to ABA, Sally served as Special Counsel in the Division of Corporation Finance and in the Office of the General Counsel at the Securities and Exchange Commission. She received her Bachelors degree from Boston University and her J.D. from American University s Washington College of Law. She is a member of the D.C. Bar. Katherine Mooney Carroll, Partner Cleary Gottlieb Steen & Hamilton LLP Katherine Mooney Carroll s practice focuses on advising U.S. and international financial institutions on U.S. regulatory matters, including recent reforms pursuant to the Dodd-Frank Act, regulatory aspects of bank M&A, cybersecurity and privacy matters, and compliance with U.S. sanctions and anti-money laundering laws. Katherine served as counselor to Secretary of Defense Ash Carter from April 2016 to January At the U.S. Department of Defense, she advised Secretary Carter on a broad range of issues, including cybersecurity and related intelligence matters, the transfer of detainees from Guantanamo Bay and lifting restrictions on service by women and transgender service members. She was awarded the Secretary of Defense Medal for Outstanding Public Service. Katherine has extensive experience advising major U.S. and non-u.s. banking organizations on the Volcker Rule, heightened prudential 18

11 Partnered with a leading law firm to provide a top Cloud Services vendor with a framework mapping the cybersecurity requirements of over 20 countries. Delivered on several Cyber Risk and Security engagement across several sectors including, Financial Services, Healthcare, Energy, and Education. Perry is also a regular contributor and presenter at several forums including at ISACA, FS-ISAC and CISO private forums. Education, Licenses & Certifications -Certified Information Systems Security Professional (CISSP) -Certified Information Security Manager (CISM) -Certified in Risk and Information Systems Control (CRISC) -Certified Information Privacy Professional (CIPP) -MS, Computer Science Bradley Mervis, Senior Manager Deloitte Brad is a Senior Manager within Deloitte s Risk and Financial Advisory practice specializing in the design and implementation of technology and cyber risk management programs. He has over 12 years of experience with a focus on regulatory compliance, process redesign and optimization, and risk assessments. He has assisted numerous banks and asset managers with assessing, designing and enhancing their information security programs in alignment with regulatory expectations. Brad is currently co-leading Deloitte s innovation efforts around the AICPA s Cybersecurity Examination Reporting Framework Sally Miller, Chief Executive Officer Institute of International Bankers Sarah (Sally) Miller is the Chief Executive Officer of the Institute of International Bankers. The IIB s mission is to help resolve the many special legislative, regulatory, tax and compliance issues confronting internationally headquartered financial institutions that engage in banking, securities and insurance activities in the United States. Collectively, the U.S. operations of internationally headquartered 17 He has extensive industry experience in the financial services, telecommunications, IT/data services, and media sectors. His clients included Lloyds Banking Group, RBS, AIG (UK) JP Morgan (UK), American Express, Emirates NBD Bank, The Saudi Stock Exchange, Samba Bank, First USA, MasterCard, Vodafone, Virgin Media, British Telecom, Telefonica/O2, RBS, Novartis, Schroder s and other International Fortune 500 companies as customers. In both capacities as an experienced consultant and technology entrepreneur and investor, James has been a guest speaker and lecturer on topics such as Cyber Security, IT Strategy and Technology product/offering development at The University of Pennsylvania, The Wharton School, Syracuse University, NYU, King Faud University and Columbia University. Professional and industry experience 2016-present: Principal in PwC's Cyber Security practice serving client across the entire spectrum of PwC's cyber security services : Led KPMG s Cyber Defence Services (CDS) covering Cyber Threat Intelligence, Incident Response, Security Architecture, Security testing. And Cyber Security Strategy. Engagement Leader for more than 20 engagements. Personally developed new services such as Threat Led Cyber Strategy, Cyber Risk Prioritisation, APT Detection, Incident Response, Cyber Threat Intelligence, Big-data Cyber Analytics and Mobile Testing : Led Booz Allen Hamilton s International Cyber Security Practice serving clients such as Etisalat, The United Arab Emirates IT Ministry, Emirates NBD, Samba Bank, The Saudi Stock Exchange, and the UAE and Saudi National Cyber Security Centres. and multiple UAE Government ministries. Authored The First180 Days as the CISO: A Concise Guide to Success, covering the CISO perspective on aligning Information Security to the organization s business strategy. Developed a standards driven unified risk and threat cyber maturity model addressing 24 controls across people, process and technology. Education: -M.B.A., The Wharton School University of Pennsylvania Philadelphia, PA -B.S., U.S. Naval Academy Annapolis, MD 10

12 David M. Homovich, Information Security Manager Credit Suisse David M. Homovich is an information security manager at Credit Suisse with 10 years of experience developing and implementing security policies, protecting information assets, and testing cyber incident response strategies. At Credit Suisse, he is responsible for implementing CISO s information security governance strategy and leading the CISO division s cybersecurity sector engagement activities. Prior to joining Credit Suisse, Mr. Homovich spent nearly 8 years at Booz Allen Hamilton where he supported the Chief Information Officer at the U.S. Department of Defense and the Office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Richard Hudson, VP of Cybersecurity & Data Protection Cordium Richard Hudson is a member of Cordium s Global Cybersecurity and Data Protection Consulting Group, which assists clients to identify and manage potential cyber risks and threats, and their regulatory requirements. Prior to joining Cordium, Richard was the Information Security Officer for 17 years at Mizuho Bank, New York Branch where he managed the information security posture for all offices in North and South America. Richard also provided a supporting role for Mizuho Alternate Investments, LLC for their cybersecurity needs to comply with SEC requirements. His core responsibilities included an extensive background in deployment of information security program management, data loss prevention, NIST Cybersecurity Framework implementation and more. Richard has also worked with many regulators (SEC, NYDFS, OSFI, JFSA, SEC) during Examinations at Mizuho with much success including several commendations from the regulators. Richard holds a Master of Science in Management and Information Systems from Fairleigh Dickinson University and a Bachelor of Science in Mathematics and Computer Science from the University of 11 SAC of the FBI s New York Special Operations/Cyber Division. Prior to his entry into the FBI, SAC Mahairas served as a Police Officer in New York City. He received a Bachelor s of Arts degree in Political Science from Baruch College and his Juris Doctor from New York Law School. Perry Menezes, Managing Director KPMG LLP Perry Menezes is a Managing Director in KPMG s Cyber Security Services Practice in the New Jersey office with over 22 years of management, technology and cybersecurity advisory and implementation experience. He leads KPMG s Cyber Security Services for the Banking sector. He is specialized in providing Information and Cyber Security, IT Risk Management, and IT Project Advisory services. Professional and Industry Experience Perry has led multiple organizations in the Financial Services industry serving global banking and capital markets clients in providing solutions for cybersecurity transformation, threat intelligence, governance, risk, regulatory and compliance functions. As member of the GTO-COO at Deutsche Bank, he was responsible for the IT Security and Risk Governance (2nd Line of Defense) where his responsibilities included building and running the technology risk function across the Americas and then Globally, conducting independent assessment of all technology and operational risks, working with the business (the 5 LOB s of DB) to proactively identify and manage their IT risk posture, report on metrics, project management, and providing subject matter expertise to functions and LOB s in regulatory, policy, compliance and audit requirements. In addition, Perry has Designed and built Technology Cyber Risk Management functions for banks under divestiture and review by the OCC. Developed a Cyber Crisis Management Framework and an interlock with Department of Treasury decision model for a top 5 US bank. Extended a compliance program to include the design of a new FFIEC compliance program for a German bank. 16

13 Force on Supervision and is a member of the G-7 Cyber Experts Group. Richard Livesley, Director Canadian Programs FS-ISAC Richard Livesley is FS ISAC s Director of Canadian Programs and a member of its Global Team. FS-ISAC, or the Financial Services Information Sharing and Analysis Center, is the global financial industry's go to resource for cyber and physical threat intelligence analysis and sharing. FS-ISAC is unique in that it was created by and for members and operates as a member-owned non-profit entity. Prior to joining FS ISAC, Richard had a 37-year career at BMO Financial Group. He retired as the Director of Strategy and Planning within BMO s cybersecurity organization. Richard s cybersecurity management career at BMO included a broad range of leadership roles including data governance, information management as well as cyber security strategy and planning. He was one of the industry s leaders in establishing the FS ISAC s Canadian presence and was member of the Canadian Banking Association s cybersecurity committee for five years. Richard has an MBA degree from McGill University. He received ISACA s risk management designations (CRISC and CGEIT) and he was previously active as member in CPA Canada s in developing Information Integrity Guidelines and served as a board member of the University of Waterloo s Center for Information Systems Assurance. Aristedes Mahairas, Special Agent in Charge, Special Operations/Cyber Division, FBI Special Agent in Charge (SAC) Aristedes Mahairas entered on duty with the Federal Bureau of Investigation (FBI) in He has served as the FBI s Legal Attache in Athens, Greece, and was a Supervisor on the Joint Terrorism Task Force. SAC Mahairas also served as a Section Chief of the Strategic Operations Section in the Counterterrorism Division of FBI Headquarters, and as the Chief of Staff to the Executive Assistant Director of the National Security Branch. In 2015, FBI Director James B. Comey appointed him as the 15 the West Indies. Richard holds a Certified Information Security Manager (CISM) certificate, NJ State Police/Department of Homeland Security Cybersecurity Analyst Certification, and Certified Information Systems Security Professional (CISSP) certificate. Yusuf Hussain, Director, Information Risk Mgmt. MUFG Union Bank, N.A. Yusuf Hussain is a Director at MUFG in Information Risk Management (IRM) responsible for building out the second line of defense in compliance with regulatory requirements and engagement in cross-industry risk management initiatives. Prior to joining MUFG, Yusuf was a Vice President at Goldman Sachs in Technology Risk responsible for the Vendor Technology Risk and Identity and Access Management programs. Prior to joining Goldman Sachs, Yusuf was a Manager at Ernst & Young in the Information Security Advisory practice. Yusuf earned a B.S. in Computer Science from CUNY s Macaulay Honors College. Jaime Kahan, Principal Ernst & Young LLP Jaime Kahan leads EY s Wealth & Asset Management Information Technology Risk & Control Practice in the Americas. She has been at Ernst & Young for over 15 years, servicing major clients in the asset management, private equity, hedge fund, investment manager, banking and capital markets, and broker/dealer sectors. Jaime is a member of the Information System Audits and Control Association (ISACA), a Certified Information System Auditor (CISA), a Certified Information Security Manager (CISM), and is Certified in Risk and Information System Controls (CRISC). She also leads training classes at Ernst & Young related to Cyber Security, IT General Controls, Audit Methodology and SOC reporting. In addition, she frequently speaks at industry conferences on the topics of Cyber Security and has published several pieces of thought leadership. Jaime graduated with honors from Binghamton University in 2000 with a degree in MIS and Marking. She obtained her MBA in Finance from New York University in June Specifically: 12

14 Jaime has led multiple Cyber Security engagements that assisted wealth and asset managers prepare for the upcoming SEC Cyber Security examinations. Led over 30 SOC reporting (SSAE 16) teams in Asset Management operational areas such as fund administration, investment Management and private equity. Led multiple current state/future state assessments at an investment advisors and managers focusing on their security programs and risk and control frameworks. Provided Internal Audit Outsourcing services to a large Asset Manager in the area of Data Leakage. Provided Internal Audit Outsourcing services to a large Hedge Fund client in the area of Data Confidentiality. Assessed and provided recommendations relating to computer security, policies, and procedures for clients. Led a global team of 20 team members in the development of a risk and control framework for a major bank. The engagement consisted of identifying the risk and controls, assessing the design and operating effectiveness of the controls, and rationalizing the controls across the bank. Michael Leiter, Partner Skadden, Arps, Slate, Meagher & Flom LLP Michael Leiter represents clients in matters involving U.S. national security and cybersecurity, cross-border transactions and government investigations, with a focus on the defense, intelligence and technology sectors. Most recently, Mr. Leiter was president of Leidos Defense, a $2.5 billion business unit of Leidos, which provides technology and solutions to the U.S. Department of Defense and allied nations globally. He joined Leidos in 2014 as chief strategy officer and executive vice president for business development, and negotiated, among other deals, its acquisition of Lockheed Martin s Information Systems and Global Solutions business an approximately $5 billion transaction. Immediately after leaving the government in 2011, Mr. Leiter served as head of global government and cyber solutions and senior counselor to the chief executive officer at Palantir Technologies, based in Palo Alto. Mr. Leiter has served in a number of senior national security positions in the federal government. He was the director of the National 13 Counterterrorism Center (NCTC) from 2007 until 2011 for both Presidents Bush and Obama, where he led the primary organization in the U.S. government for analysis and integration of all terrorism intelligence, both domestically and overseas. In addition, Mr. Leiter reported directly to the president for strategic operational planning of all U.S. counterterrorism activities, to include the integration of military, intelligence, cyber, diplomatic, financial and homeland security programs and operations. In this role and in his private sector capacities, Mr. Leiter worked extensively with senior government officials and corporations across Europe, the Middle East, Asia, Australasia and Africa. Before NCTC, Mr. Leiter helped establish the Office of the Director of National Intelligence, serving as its deputy chief of staff responsible for oversight of the U.S. intelligence community, including the CFIUS process and all legislative affairs. He also served as the deputy general counsel and assistant director of the President s Commission on the Intelligence Capabilities of the United States Regarding Weapons of Mass Destruction. Education -J.D., Harvard Law School, 2000 (magna cum laude; President (Editor-in-Chief), Harvard Law Review) -A.B., Columbia University, 1991 Bar Admissions Colorado, District of Columbia, Massachusetts, U.S. Court of Appeals for the First Circuit Arthur Lindo, Senior Associate Director Federal Reserve Board Arthur Lindo (Art) is the Senior Associate Director for Policy in the Federal Reserve Board's Division of Supervision and Regulation. His principal responsibilities include the development and assessment of the effectiveness of Board regulations and policy matters affecting the domestic financial services sector. He also advises the Board on emerging policy matters that have implications for the supervision and regulation of the global financial services sector. He serves on the Operating Committee for the Board s Large Institution Supervision Coordinating Committee (LISCC) and the Oversight Committee for the Board s Partnership for Progress program. He is the Chairman of the Appraisal Subcommittee of the Federal Financial Institutions Examination Council (FFIEC), the Chairman of the FFIEC s Task 14