• CIBC uses a three lines of defence model: Information Security (responsible for execution of the cyber program) and all lines of business; Risk Management (provides risk oversight and challenge); and, Internal Audit (independent evaluation through periodic audits).