5 unchanged sentences
Our cybersecurity policies and practices are designed to follow the cybersecurity framework of the National Institute of Standards and Technology and other applicable industry standards.
+Added: 46 Huntington Bancshares Incorporated
Consistent with Huntington’s overall ERM policies and practices, our cybersecurity program includes:
16 unchanged sentences
The results of such assessments and reviews are reported to the Technology Committee and the Board when appropriate, and we adjust our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.
−Removed: 2024 Form 10-K 43
The Technology Committee oversees the management of risks from cybersecurity threats, including the policies, processes and practices that management implements to address risks from cybersecurity threats.
3 unchanged sentences
The entire Board also participates in periodic cyber-related tabletop exercises.
−Removed: Huntington’s Chief Information Security Officer is a member of our Technology Risk Committee, a management-level committee that is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across Huntington.
−Removed: The Chief Information Security Officer also works with members of the ELT, which includes our Chief Executive Officer, Chief Financial Officer, Chief Risk Officer, and General Counsel.
+Added: Huntington’s Chief Information Security Officer is a member of our Information Technology Risk Committee, a management-level committee that is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across Huntington.
+Added: The Chief Information Security Officer also works with members of the ELT, which includes our Chief Executive Officer, Chief Financial Officer, Chief Risk Officer, Chief Information Officer, and General Counsel.
+Added: 2025 Form 10-K 47
The Chief Information Security Officer works collaboratively across Huntington to implement a program designed to identify and protect our information systems from cybersecurity threats and to promptly detect and respond to cybersecurity incidents.
3 unchanged sentences
In addition, members of our Board and management hold varying levels of relevant cybersecurity certifications.
+Added: While we, and the third parties with whom we work, have experienced cybersecurity incidents, as well as adverse impacts from such incidents, we have not experienced material losses or other material consequences resulting from cybersecurity incidents experienced by us or such third parties.
+Added: However, we expect to continue to experience cybersecurity incidents resulting in adverse impacts with increased frequency and severity due to the evolving threat environment including the increasing use of AI by cyber threat actors, and there can be no assurance that future cybersecurity incidents, including incidents experienced by our third parties, will not have a material adverse impact on the Corporation, including its business strategy, results of operations and/or financial condition.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.