2 unchanged sentences
CYBERSECURITY RISK MANAGEMENT AND STRATEGY
−Removed: Old National’s enterprise risk management program is designed to identify, assess, and mitigate various financial, operational, regulatory, legal, and reputational risks.
+Added: Old National’s enterprise risk management program is designed to identify, assess, and mitigate various financial, operational, regulatory, legal, and other risks.
Cybersecurity is a critical component of that program, especially in light of the significant, persistent, and ever-evolving cybersecurity risks facing us and other financial institutions.
−Removed: For further discussion of such risks, see the section entitled “Risk Factors” in Item 1A of this Form 10-K under the heading “Operational Risks.” Our objective is to maintain a robust cybersecurity program designed to protect the confidentiality, integrity and availability of our information systems and critical operational processes , including through identification of material information assets and systems, deployment of controls designed to protect against known cybersecurity threats, prompt detection of any cybersecurity threats that make it past our
−Removed: defenses, maintenance of documented, tested approaches for responding to cybersecurity threats and establishment of recovery techniques and technologies to promote resilience from any cybersecurity incidents.
+Added: For further discussion of such risks, see the section entitled “Risk Factors” in Item 1A of this Form 10-K under the heading “Operational Risks.” Our objective is to maintain a robust cybersecurity program designed to protect the confidentiality, integrity and availability of our information systems and critical operational processes , including through identification of material information assets and systems, deployment of controls designed to protect against known cybersecurity threats, prompt detection of any cybersecurity threats that make it past our defenses, maintenance of documented, tested approaches for responding to cybersecurity threats and establishment of recovery techniques and technologies to promote resilience from any cybersecurity incidents.
As a result, the Company has developed and maintains an Information Security Program (“ISP”) and various related policies, standards, guidelines, and procedures, as a core part of its enterprise risk management program.
13 unchanged sentences
The team also regularly collects and communicates to management relevant data on cybersecurity threats and risks, including through monthly cybersecurity scorecards on the status of and potential risks to key initiatives and controls, and conducts an enterprise-wide cybersecurity risk assessment at least annually.
−Removed: I n addition, we obtain inputs from industry and government associations, third-party benchmarking, and threat intelligence resources and updates.
+Added: In addition, we obtain inputs from industry and government associations, third-party benchmarking, and threat intelligence resources and updates.
We leverage internal auditors and third-party consultants to periodically review the processes, systems, and controls underlying our ISP and assess their design, operating efficacy, and program maturity, as well as to make recommendations to enhance their currency and effectiveness.
1 unchanged sentence
TPRM leaders report into and operate under the supervision of our Corporate Risk Management department.
−Removed: The TPRM program seeks to build into the Company’s business processes an appropriate level of cybersecurity due diligence prior to engagement of, and during the relationship lifecycle with, third parties.
+Added: The TPRM program seeks to build into the Company’s business processes an appropriate level of cybersecurity due diligence prior to engagement of, and during the
+Added: relationship lifecycle with, third parties.
We generally seek security-related confirmations from our third-party suppliers, including as to their adherence to appropriate information handling and asset management requirements and their provision to us of notifications in the event of any known or suspected cybersecurity incidents.
−Removed: While we have no knowledge that we have experienced a cybersecurity incident that has had or is reasonably likely to have a material adverse impact on our operations or financial results as of the date of this Form 10-K, there can be no assurance that we will not encounter such an incident in the future, notwithstanding the cybersecurity measures and processes we have undertaken.
+Added: The Company experienced no material data breaches or cybersecurity incidents on its systems in 2025.
+Added: There can be no assurance that we will not encounter such an incident in the future, notwithstanding the cybersecurity measures and processes we have undertaken.
Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, remediating or restoring our internal systems or information, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm.
4 unchanged sentences
The Company’s enterprise Information Security department is primarily responsible for monitoring and managing the Company’s ISP, under the supervision of Old National’s Chief Information Security Officer (“CISO”) .
−Removed: Information Security department’s responsibilities generally include cybersecurity risk assessment, identification and implementation of preventive measures, incident response, vulnerability assessment, threat intelligence, identity access governance, and business continuity and resilience.
+Added: The Information Security department’s responsibilities generally include cybersecurity risk assessment, identification and implementation of preventive measures, incident response, vulnerability assessment, threat intelligence, identity access governance, and business continuity and resilience.
Old National has adopted an enterprise risk strategy, including for cybersecurity risks, premised on three lines of defense.
12 unchanged sentences
Members of the ISTRM and the other referenced management committees include the CRO, the CISO, the Chief Information Officer, key senior business operating managers and functional leaders, and other representatives from the Company’s Information Security department .
−Removed: Coordination among these committees, and with other business management committees operating outside the auspice of the Company’s Information Security or Enterprise Risk departments, is intended to help Old National address information security questions in a consistent, coordinated fashion, maintain front-line visibility of the ISP, and promote compliance with Old National security policies and standards.
+Added: Coordination among these committees, and
+Added: with other business management committees operating outside the auspice of the Company’s Information Security or Enterprise Risk departments, is intended to help Old National address information security questions in a consistent, coordinated fashion, maintain front-line visibility of the ISP, and promote compliance with Old National security policies and standards.
The Enterprise Risk Committee of the Company’s Board of Directors (the “Risk Committee”) is responsible for oversight of the Company’s enterprise-wide risks as set forth in its charter.
3 unchanged sentences
Notwithstanding the extensive approach we take to cybersecurity, the Company continues to face risks and accompanying threats that could have a material adverse effect on the enterprise.
−Removed: We work to manage these risks and
−Removed: threats on a daily basis.
+Added: We work to manage these risks and threats on a daily basis.
We continue to invest in our cybersecurity program, the resiliency of our networks, and work to enhance our internal controls.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.