What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-16 compared with 2025-03-17 · 38 added, 46 removed, 0 unchanged (100% of the section changed)

ITEM 1B UNRESOLVED STAFF COMMENTS

ITEM 1C CYBERSECURITY

As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations and reputation, including, but not limited to, cyber-attacks against us or our critical third-party service providers.

These cyber-attackers can attempt to gain unauthorized access to our digital systems for malicious purposes including, but not limited to:

misappropriation of company assets, accessing Company confidential or sensitive customer non-public information, corrupting data, causing operational disruptions, or as part of a ransom demand for payment.

As described below, we believe we have appropriate risk management processes, governance policies, standards, and procedures, a system of internal controls designed to address and mitigate these risks, and experienced internal resources to execute our information security and cybersecurity risk management programs .

In 2024, the Company’s Board of Directors approved the hiring of a full time Chief Information Security Officer (“CISO”) reporting to the Company’s Chief Information Officer (“CIO”) to support a focus on information security and support the three lines of defense enterprise risk management framework.

Our defense enterprise risk management framework includes processes and procedures used to identify, assess, mitigate, and monitor the risks faced by the Company, including cybersecurity risk.

Within the three lines of defense framework for cybersecurity risk, the first line of defense is provided by the Information Technology department and business lines, which are responsible for the design and execution of information security practices and risk mitigation.

The second line of defense is provided by the Enterprise Risk Management department (led by the Company’s Independent Chief Risk Officer (“CRO”)) and the CISO (reporting to the CIO).

The second line of defense seeks to identify, assess, and monitor cyber risk, in collaboration with our first line, while maintaining independence in the oversight of our information security program.

The CISO has dotted-line reporting to the CRO.

The CRO is independent of management and reports to the Board Risk Committee Chair.

The third line of defense is independent Internal Audit, led by our Head of Internal Audit, who is responsible for ensuring that the first and second lines of defense are both designed and operationally effective in mitigating cybersecurity risk through internal audits of including but not limited to:

cybersecurity, electronic banking, GLBA/Privacy, information security, information technology, and vendor risk management.

The Head of Internal Audit is independent of management and reports to the Board Audit Committee Chair.

Our CISO, CRO, CIO, and Head of Internal Audit have nearly seven decades of combined work experience, including six decades in banking and financial services risk management and information security roles, and maintain several industry licenses and certifications through continuing professional education.

The Company’s information security program is designed to preserve the confidentiality, integrity, and availability of Company confidential information, customer non-public personal information, and other data on our systems as well as securing our interfaces with our critical third-party service providers.

Our information security program takes a risk-based approach to identifying and assessing the cybersecurity risks that exist within our business and information technology systems.

The program addresses the roles and responsibilities of the Board, its committees, management, management’s committees, as well as each individual Company employee.

The Board of Directors is ultimately responsible for the oversight of cybersecurity risk management, with the Board Risk Committee assisting the Board with oversight of the Company’s cybersecurity risk program and reporting.

The Board of Directors appoints the CISO, and the CISO is given the full authority of the Board for administering and executing the Company’s written information security program.

The CRO and CISO deliver reports to the full Board of Directors on the status and effectiveness of the Company’s written information security program, and reports to the Board Risk Committee any emerging threats or cyber risks on a periodic basis throughout the year.

The Board Risk Committee has also approved an Information Security and Cybersecurity Risk Appetite Statement.

At the management level, the Enterprise Risk Management Committee (“ERMC”) is primarily responsible for cybersecurity risk management.

The Committee is comprised of senior executives with risk management and information security expertise.

The Information Technology Steering Committee (“ITSC”) is a sub-committee of ERMC and is also comprised of senior executives and staff with risk management and information security expertise.

ITSC governs the first line of defense cybersecurity risk management activities and furnishes approval items, status reports, and approved Committee minutes to ERMC following a meeting.

ERMC governs the second line of defense cybersecurity risk management activities and furnishes key risk indicators, risk assessments, reports, issues and committee minutes to the Board Risk Committee.

The CISO assigns quarterly cyber security training to all Company employees and ERMC reviews and approves the training curriculum on an annual basis.

Additionally, the CISO ensures the Board receives annual cyber security training.

We strive to minimize the occurrence of cybersecurity incidents and the risks resulting from such incidents.

However, when a cybersecurity incident does occur, the Company has in place an incident response program to guide our assessment of and response to the incident.

The CISO coordinates the Company’s response to a cybersecurity incident, including investigating, recording and evaluating any potential, suspected or confirmed incidents involving non-public customer information or Company confidential information.

The CRO informs senior management and the Board Risk Chair and Board Audit Committee Chair as soon as practical if a significant security incident occurs.

Formal incident reports, if/when applicable, are reviewed by ITSC, ERMC, and the Board Risk Committee.

The Company employs third parties in fulfilling certain aspects of its information security and cybersecurity programs.

For example, we engage third parties to:

monitor our network 24/7/365, escalate security alerts, when applicable, perform penetration testing, conduct social engineering tests and assist management with technology upgrades/installations.

The CISO monitors information risks posed by third parties and any non-compliance with the controls created to address such risks.

With respect to cybersecurity incidents affecting our third-party service providers, the CISO, CRO, and their respective teams, work with our service providers to understand and document any incidents, along with managing the impact to us and reporting such significant incidents to senior management, ITSC, ERMC, and the Board Risk Committee.

While we believe that our cybersecurity programs are appropriate to our risks, cybersecurity threats are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of Internet banking, mobile banking and other technology-based products and services by us and our customers.

Notwithstanding the investments made in mitigating our cybersecurity risks, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company.

As of the date of this filing, the Company is not aware of any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.

For further discussion, please see Item 1A.

“Risk Factors” for a discussion of cybersecurity risks.

UNRESOLVED STAFF COMMENTS

CYBERSECURITY

As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations, and reputation, including cyber-attacks against us or our critical third-party service providers.

Cyber-attackers may attempt to gain unauthorized access to our systems for purposes such as misappropriation of Company assets, accessing confidential or sensitive customer non-public information, corrupting or destroying data, disrupting operations, or making ransom demands.

Cybersecurity threats continue to evolve in both frequency and sophistication as financial institutions increasingly rely on digital channels, remote connectivity, cloud-based services, and third-party technology providers.

While we devote significant resources to managing these risks, no cybersecurity controls or procedures can provide absolute assurance that a cybersecurity incident will not occur.

Our information security program is designed to preserve the confidentiality, integrity, and availability of Company confidential information, customer non-public personal information, and other data maintained on our systems, as well as to secure our interfaces with critical third-party service providers.

The program is risk-based and tailored to the size, complexity, and risk profile of the Company and is integrated into the Company’s broader enterprise risk management framework.

The cybersecurity program includes administrative, technical, and physical safeguards intended to identify, assess, manage, and monitor cybersecurity risks across the organization.

Risk assessments are conducted periodically and in connection with material technology changes, new products, and third-party relationships.

Identified risks are prioritized and addressed through remediation activities, risk acceptance, or other mitigation strategies consistent with the Company’s risk appetite.

Additionally, the Company continually works to align its policies and practices with industry-accepted information security practices as provided by the Cyber Risk Institute, Payment Card Industry Data Security Standards, and other applicable standards, laws, and regulations.

Cybersecurity risk considerations are incorporated into strategic planning, technology initiatives, and day-to-day business operations.

The Company maintains written policies, standards, and procedures designed to address evolving cybersecurity threats and regulatory expectations.

These policies define roles and responsibilities for employees and contractors and are supported by ongoing training and awareness activities.

The Company utilizes a combination of internal resources and external service providers to support elements of its cybersecurity program, including security monitoring, threat intelligence, vulnerability management, penetration testing, social engineering testing, and incident response preparedness.

These activities are designed to enhance the Company’s ability to prevent, detect, and respond to cybersecurity threats in a timely manner.

T he Board of Directors is ultimately responsible for the oversight of cybersecurity risk management.

The Board, primarily through its Risk Committee , receives periodic updates from management regarding the status and effectiveness of the Company’s information security program, key risk indicators, emerging cybersecurity threats, and significant risk management initiatives.

The Board also receives cybersecurity education to support informed oversight.

Management is responsible for implementing and maintaining the Company’s cybersecurity risk management program.

Cybersecurity oversight is conducted through established management

committees comprised of senior executives with risk management, technology, and information security expertise.

These committees provide direction, review program performance and risk metrics, approve key initiatives, and escalate significant matters to senior management and the Board, as appropriate.

The Company employs a Chief Information Security Officer who is responsible for administering and executing the Company’s written information security program and coordinating cybersecurity risk management activities across the organization.

The Chief Information Security Officer works closely with other members of management to align cybersecurity practices with business objectives and regulatory requirements.

The Company maintains a cybersecurity incident response program designed to guide the assessment of and response to cybersecurity incidents.

The program includes defined procedures for incident identification, investigation, documentation, escalation, and communication.

Incident response plans are periodically reviewed and tested to promote preparedness and coordination across the organization.

In the event of a significant cybersecurity incident, senior management and the Board are informed in accordance with established escalation protocols.

The Company also evaluates whether incidents require notification to customers, regulators, or other stakeholders, as applicable, based on the nature and severity of the incident and applicable legal and regulatory requirements.

The Company manages cybersecurity risks associated with third-party service providers through a third-party risk management program that includes risk-based due diligence, contractual security requirements, and ongoing monitoring.

The Company seeks to obtain appropriate assurances regarding third-party security controls and incident notification obligations and monitors third-party performance throughout the lifecycle of the relationship.

While the Company believes that its cybersecurity risk management practices are appropriate for its business and risk profile, cybersecurity threats remain a persistent and evolving risk.

The increasing reliance on technology, interconnected systems, and third-party providers heightens the potential impact of a cybersecurity incident.

As of the date of this filing, the Company is not aware of any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations, or financial condition.

For additional discussion of cybersecurity-related risks, see Item 1A.

“Risk Factors.”

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments