2 unchanged sentences
Risk Management and Strategy
−Removed: The Company's information security program is designed with the goal of maintaining the safety and security of our systems and data and we employ a holistic process for overseeing and managing cybersecurity and related risks.
−Removed: This process is supported by both management and our board of directors.
+Added: 25 TriCo Bancshares 2025 10-K
+Added: The Company's information security program is designed to maintain the confidentiality, integrity, and availability for our systems and data, and we employ a holistic process for overseeing and managing cybersecurity and related risks.
+Added: This process is integrated into our enterprise risk management framework and is supported by both management and our board of directors.
Our risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal.
1 unchanged sentence
Our Chief Information Security Officer (“CISO”) is primarily responsible for this cybersecurity component and, as discussed below, periodically reports to the Information Technology/Cybersecurity Committee (“IT/Cybersecurity Committee”) of our board of directors.
−Removed: Our objective for managing cybersecurity risk is to avoid or minimize the impacts efforts to penetrate, disrupt or misuse our systems or information.
−Removed: The structure of our information security program is designed around the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”), regulatory guidance, and other industry standards.
+Added: Our objective for managing cybersecurity risk is to prevent, detect, respond to, an recover from efforts to penetrate, disrupt, or misuse our systems or information.
+Added: The structure of our information security program is aligned with the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework (“CSF”), applicable regulatory guidance, and other industry standards.
This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.
4 unchanged sentences
We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists.
−Removed: We engage third parties, including vendors and other external service providers, to support our cybersecurity and data privacy processes such as risk assessments, program enhancements, and value-added user verification services.
+Added: We engage qualified third parties, including independent assessors and external service providers, to support our cybersecurity and data privacy processes, including risk assessments, control validation, penetration testing, and program enhancements.
These third parties provide security services, including regular reviews of our security environment to provide an independent, industry-recognized risk rating and internal audits of our technology and security controls.
−Removed: Further, we deploy technical safeguards that we believe are designed to help protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, endpoint detection and response, logging, monitoring and alerting, anti-malware functionality, email security, network security monitoring and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.
+Added: Further, we deploy technical safeguards designed to help protect our information systems from cybersecurity threats, including firewalls, multi-factor authentication, privileged access controls, endpoint detection and response solutions, logging, monitoring and alerting, email security, network security monitoring and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.
Our third-party risk management program includes processes for identifying and managing material cybersecurity risks arising from third-party providers.
−Removed: The program actively engages with the enterprise-wide risk assessment process and partners with cyber risk management to report relevant risks to the IT/Cybersecurity Committee of our board of directors.
+Added: The program is integrated into our enterprise-wide risk assessment process and reports relevant risks to the IT/Cybersecurity Committee of our board of directors.
Furthermore, our third-party risk management program includes cybersecurity as an aspect of its risk assessment of third parties with the objective that key risks are identified and addressed.
Moreover, the program also considers risks associated with certain fourth parties, entities that are partners or subcontractors of our direct third-party vendors, through assessments carried out internally and by our third-party service providers.
+Added: This plan is tested periodically through tabletop exercises and simulations.
We maintain an Incident Response Plan that provides a documented framework for responding to actual or potential cybersecurity incidents, including timely notification of and escalation to the appropriate board-approved management committees, as discussed further below, and to the IT/Cybersecurity Committee of our board of directors.
The Incident Response Plan is coordinated through the CISO and key members of management are embedded into the plan by its design.
−Removed: This pIan facilitates coordination across multiple parts of our organization and is evaluated at least annually.
+Added: This plan facilitates coordination across multiple parts of our organization and is evaluated at least annually.
Lastly, we leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness and make recommendations to strengthen our risk management program.
1 unchanged sentence
Our CIO and CISO have served in their positions since joining the Company in June, 2022 and January, 2022, respectively.
−Removed: Our CIO, who reports directly to the Chief Operating Officer, has 30 years of experience in various technology and security leadership positions across multiple industries including banking, insurance services, utilities, technology service providers, and as a member of the US Air Force.
+Added: Our CIO, who reports directly to the Chief Executive Officer, has 30 years of experience in various technology and security leadership positions across multiple industries including banking, insurance services, utilities, technology service providers, and as a member of the US Air Force.
Prior to joining us, our CIO served as a CIO for multiple banks leading both technology and cybersecurity.
−Removed: Our CISO, reporting directly to the CIO, has over 35
−Removed: 26 TriCo Bancshares 2024 10-K
−Removed: T a ble of Contents
−Removed: years of experience in various technology and security leadership positions across multiple industries including banking, healthcare, automotive, mining, education, engineering, construction, and dairy product production.
+Added: Our CISO, reporting directly to the CIO, has over 35 years of experience in various technology and security leadership positions across multiple industries including banking, healthcare, automotive, mining, education, engineering, construction, and dairy product production.
Our board of directors has approved various management committees including the IT/Cybersecurity Committee, which provides oversight and governance of the technology program and the information security program, as well as oversight and governance of the Company’s data and its storage.
This committee is chaired by the CIO and includes various employees within the enterprise information security department, including the CISO, and other key departmental managers from throughout the entire company, including information technology, risk, compliance, operations and human resources/training.
−Removed: This committee generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security, data risks and incidents.
+Added: This committee generally meets quarterly to provide oversight of the risk management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security, data
+Added: 26 TriCo Bancshares 2025 10-K
+Added: risks and incidents.
The committee reports its findings to the management Enterprise Risk Committee.
19 unchanged sentences
For example, in 2023, one of our third-party vendors experienced a cybersecurity incident due to a previously unknown (i.e., zero-day) vulnerability in a popular file sharing software the vendor used called MOVEit Transfer.
−Removed: To date, none of these incidences have materially affected or are reasonably likely to materially affect the Company or our financial position or results of operations.
+Added: To date, none of these incidents have materially affected or are reasonably likely to materially affect the Company or our financial position or results of operations.
Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is severe.
4 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.