Unresolved Staff Comments
−Removed: 40 Huntington Bancshares Incorporated
Cybersecurity
Cybersecurity represents an important component of Huntington’s overall cross-functional approach to risk management.
−Removed: Our cybersecurity practices are integrated into Huntington’s ERM approach, and cybersecurity risks are among the core enterprise risks identified for oversight by our Board of Directors (“Board”) through our annual ERM assessment.
+Added: Our cybersecurity practices are integrated into Huntington’s ERM approach, and cybersecurity risks are among the core enterprise risks identified for oversight by our Board through our annual ERM assessment.
See “ Risk Factors—Operational Risks ” for information on risks from cybersecurity threats.
−Removed: Our cybersecurity policies and practices follow the cybersecurity framework of the National Institute of Standards and Technology and other applicable industry standards.
+Added: Our cybersecurity policies and practices are designed to follow the cybersecurity framework of the National Institute of Standards and Technology and other applicable industry standards.
Consistent with Huntington’s overall ERM policies and practices, our cybersecurity program includes:
−Removed: We maintain a global cybersecurity threat operation designed to detect, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions to our business.
+Added: We maintain a global cybersecurity threat operation designed to detect, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions, compromises, and failures to our business.
• Collaboration:
6 unchanged sentences
• Incident Response Planning:
−Removed: We have established and maintain incident response plans that address our response to a cybersecurity incident, and such plans are tested at least annually, or more frequently as needed.
+Added: We have established and maintain incident response plans that are designed to address our response to a cybersecurity incident, and such plans are tested at least annually, or more frequently as needed.
• Communication and Coordination:
−Removed: We utilize a cross-functional approach to evaluating the risk from cybersecurity threats, involving management personnel from the technology, operations, legal, risk management, internal audit, and other key business functions, as well as members of our Board and the Technology Committee of the Board regarding cybersecurity threats and incidents.
+Added: We utilize a cross-functional approach to evaluating the risk from cybersecurity threats and incidents, involving management personnel from our technology, operations, legal, risk management, internal audit, and other key business functions, as well as members of our Board and the Technology Committee of the Board (the “Technology Committee”).
• Governance:
1 unchanged sentence
A key part of Huntington’s strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, and other exercises focused on evaluating effectiveness.
−Removed: We regularly engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, and independent reviews of our information security control environment and operating effectiveness.
−Removed: The results of such assessments and reviews are reported to the Technology Committee and the Board, and we adjust our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.
−Removed: The Technology Committee of the Board oversees the management of risks from cybersecurity threats, including the policies, processes and practices that management implements to address risks from cybersecurity threats.
−Removed: The Board and the Technology Committee each receive regular presentations and reports on cybersecurity risks which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to peers and vendors.
−Removed: The Board and the Technology Committee also receive prompt information regarding the occurrence of any potentially material cybersecurity incidents, including ongoing updates, when applicable.
−Removed: To keep the Board apprised of the continually shifting landscape, the Chief Information Security Officer provides updates to the Technology Committee on information security and cybersecurity matters on at least a quarterly basis, and more frequently as necessary.
−Removed: The entire Board also participates in periodic cyber-related tabletop exercises.
+Added: We regularly engage third parties to perform assessments on our cybersecurity measures, including cybersecurity maturity assessments, and independent reviews of our cybersecurity control environment and operating effectiveness.
+Added: The results of such assessments and reviews are reported to the Technology Committee and the Board when appropriate, and we adjust our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.
2024 Form 10-K 43
−Removed: Huntington’s Chief Information Security Officer is a member of our Information and Technology Risk Committee that is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across Huntington.
+Added: The Technology Committee oversees the management of risks from cybersecurity threats, including the policies, processes and practices that management implements to address risks from cybersecurity threats.
+Added: The Board and the Technology Committee each receive regular presentations and reports on cybersecurity risks which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and cybersecurity considerations arising with respect to peers and vendors.
+Added: The Board and the Technology Committee are notified by the CEO regarding the occurrence of any potentially material cybersecurity incidents, including ongoing updates, when applicable.
+Added: To keep the Technology Committee apprised of the continually shifting landscape, the Chief Information Security Officer provides updates to the Technology Committee on cybersecurity matters on at least a quarterly basis, and more frequently as necessary.
+Added: The entire Board also participates in periodic cyber-related tabletop exercises.
+Added: Huntington’s Chief Information Security Officer is a member of our Technology Risk Committee, a management-level committee that is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across Huntington.
The Chief Information Security Officer also works with members of the ELT, which includes our Chief Executive Officer, Chief Financial Officer, Chief Risk Officer, and General Counsel.
−Removed: We believe our Board and management have the appropriate expertise, background, and depth of experience to manage risks arising from cybersecurity threats including applicable knowledge gained through industry experience, academia, ongoing internal and external training, and regular discussions with consultants and peers with applicable knowledge and expertise.
−Removed: In particular, one of our Board members has an extensive cybersecurity background, including having most recently served as the first-ever U.S.
−Removed: National Cyber Director.
−Removed: In addition, other members of our Board and management hold varying levels of relevant cybersecurity certifications.
−Removed: The Company’s Chief Information Security Officer works collaboratively across Huntington to implement a program designed to identify and protect our information systems from cybersecurity threats and to promptly detect and respond to cybersecurity incidents.
+Added: The Chief Information Security Officer works collaboratively across Huntington to implement a program designed to identify and protect our information systems from cybersecurity threats and to promptly detect and respond to cybersecurity incidents.
To facilitate this program, multi-disciplinary teams throughout Huntington are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with Huntington’s incident response plan.
−Removed: Through ongoing communications across the organization, the Chief Information Security Officer monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents in real time, and reports such incidents to the CEO and the Technology Committee and the Board when appropriate, as discussed above.
+Added: Through ongoing communications with these multi-disciplinary teams and across Huntington, the Chief Information Security Officer regularly monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents on an ongoing basis, and reports such threats and incidents to the CEO, who then reports to the Technology Committee and the Board when appropriate, as discussed above.
+Added: We believe our Board and management, including the Chief Information Security Officer, have the appropriate expertise, background, and depth of experience to manage risks arising from cybersecurity threats, including applicable knowledge gained through industry experience, academia, ongoing internal and external training, and regular discussions with consultants and peers with applicable knowledge and expertise.
+Added: In addition, members of our Board and management hold varying levels of relevant cybersecurity certifications.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.