What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2025-03-07 compared with 2024-03-07 · 20 added, 28 removed, 26 unchanged (65% of the section changed)

3 unchanged sentences

Cybersecurity is a critical component of our overall risks given the increasing reliance on technology and potential of cyber threats.

Our Chief Information Security Officer is primarily responsible for this cybersecurity component and is a member of the information technology organization, reporting directly to the Chief Information Officer and regularly reports on the state of the program to the Risk Committee of our Bank’s Board of Directors.

Our Chief Information Security Officer (“CISO”) is primarily responsible for this cybersecurity component and is a member of the enterprise risk management organization, reporting directly to the Chief Risk Officer and regularly reports on the state of the program to the Information Security Committee and the Risk Committee of the Board of Directors.

In addition, the CISO works in conjunction with the Chief Information Officer (“CIO”) and Chief Technology Officer (“CTO”) to address technology strategy, controls, and processes to ensure the security of the network, data, and services for the Bank.

The CIO reports Information Technology activities through the Information Technology Steering Committee and the Bank’s Board of Directors.

Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information.

The structure of our information security program is designed around the Federal Financial Institutions Examination Council (“FFIEC”) regulatory guidance, and other industry standards such as the Center for Internet Security (“CIS”).

In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence feeds to facilitate and promote program effectiveness.

Our Chief Information Security Officer and our Chief Information Officer regularly collaborate with industry groups to discuss cybersecurity trends and issues and identify best practices.

In addition, we leverage certain industry and government associations, third-party benchmarking, audits, and threat intelligence to facilitate and promote program effectiveness.

Our Chief Information Security Officer, Chief Technology Officer, and our Chief Information Officer regularly collaborate with industry groups to discuss cybersecurity trends and issues and identify best practices.

The information security program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions.

4 unchanged sentences

We also maintain a third-party risk management program designed to identify, assess, and manage risks, including cybersecurity risks, associated with external service providers and our supply chain.

We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote

connections as a significant portion of our workforce has the option to work remotely.

We also actively monitor our email gateways for malicious phishing email campaigns and monitor remote connections as a significant portion of our workforce has the option to work remotely.

We leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.

Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe.

Therefore, we will experience risk to potential vulnerabilities now and in the future but have built a program to recognize and respond to these vulnerabilities for the purposes of identification and remediation of those vulnerabilities and the impact they can have on our business.

Therefore, we will experience risk to potential vulnerabilities now and in the future but have built a program to recognize and respond to these threats and/or vulnerabilities for the purposes of identification and remediation of those threats and/or vulnerabilities and the impact they can have on our business.

Our internal systems, processes, and controls are designed to mitigate loss from cyber-attacks.

7 unchanged sentences

Risk Factors .

Our Chief Information Security Officer is accountable for managing our enterprise information security department and delivering our information security program.

The responsibilities of this department include cybersecurity risk assessment, threat intelligence, control evaluation and assessment, incident response, vulnerability assessment, threat intelligence, third-party risk management, change management, and business resilience.

Our CISO is accountable for managing our enterprise information security department and delivering our information security program.

The responsibilities of this department include cybersecurity risk assessment, threat intelligence, control evaluation and assessment, monitoring and incident response, vulnerability assessment, third-party risk management, change management, and business resilience.

The foregoing responsibilities are covered on a day-to-day basis by a first line of defense function.

The second line of defense function is separated from the first line of defense function through organizational structure and overall cybersecurity management is independently reviewed by a third line through the audit function.

The department, as a whole, consists of information security professionals with varying degrees of education and experience.

The department consists of information security professionals with varying degrees of education and experience.

Individuals within the department are generally subject to professional education and certification requirements.

In particular, our Chief Information Security Officer has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management.

Various management committees exist including the Information Technology Steering Committee, which focuses on technology impact.

This committee provides oversight and governance of the technology program and the information security program.

This committee is chaired by the Chief Information Officer and includes other executives across the Bank and the Chief Information Security Officer is a part of this committee.

This committee meets quarterly to provide oversight of technology projects and services including strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks.

The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at the meeting and the actions taken to the Risk Committee of our Board of Directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

The Risk Committee of our Bank’s Board of Directors is responsible for overseeing our information security and technology programs, including management’s actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks.

Our Chief Information Security Officer and our Chief Information Officer provide quarterly reports to the Risk Committee of our Bank’s Board of Directors regarding the information security program and the

technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.

The Risk Committee of our Bank’s Board of Directors reviews and approves our information security policies and strategies.

The Risk Committee of our Bank’s Board of Directors provides a report of their activities to the full Board of Directors at each board meeting.

Vendor Incident

As disclosed in our Form 8-K filed on July 14, 2023 , on or about May 31, 2023, we were informed by a third-party vendor of a zero-day vulnerability in the vendor’s managed file transfer software MOVEit (the “Vendor Incident”).

The Bank utilizes MOVEit for securely transferring sensitive and confidential information and other data, including for its First National 1870 and Guardian Mortgage divisions.

We publicly disclosed this breach and provided appropriate notifications to potentially impacted customers.

We now understand that the SEC is conducting an investigation into data breaches resulting from the failures in the Progress software and on or about February 26, 2024, we received a request from the SEC to preserve and provide various documents and information relating to the SEC’s investigation.

The fact that the SEC has begun an investigation does not mean that the SEC believes that anyone (including FirstSun) has violated federal securities laws, nor does it mean that the SEC has a negative opinion of any person, entity, or security.

It is a non-public fact-finding inquiry, with which we intend to fully cooperate.

The costs associated with the Vendor Incident have not had, and neither it nor the SEC’s investigation (including responding to any information requests from the SEC) are expected to have a material adverse impact on the Company’s financial condition or results of operation.

Various management committees exist including the Information Security Committee, which focuses on technology risk, controls and the information security program.

This committee provides oversight and governance of the information security program and technology risks.

This committee is chaired by the Chief Information Security Officer and includes other executives across the Bank, including the Chief Information Officer and Chief Technology Officer .

This committee meets quarterly to provide oversight of information security projects and services including strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks.

The Chief Information Security Officer reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at the meeting and the actions taken to the Risk Committee of the Board of Directors on a quarterly basis (or more frequently as may be required by the Incident Response Plan).

The Risk Committee of the Board of Directors is responsible for overseeing our information security program, including management’s actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks.

Our Chief Information Security Officer provides quarterly reports to the Risk Committee of the Board of Directors regarding the information security program, key enterprise cybersecurity initiatives and other matters relating to cybersecurity processes.

The Risk Committee of the Board of Directors reviews and approves our information security policies and strategies.

The Risk Committee of the Board of Directors provides a report of their activities to the full Board of Directors at each board meeting.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments