text: To control cyber risks at third parties and protect customer data and systems, PNC assesses suppliers and third parties through a third-party security program that includes periodic security assessment. The third-party security program also includes regular monitoring of certain third parties using an independent security rating service that is designed to ensure insight and alerting is available at scale. In the event of an incident at a third party, there are specific incident response processes and protocols in place that are designed to protect PNC from potential adverse impacts.


text: We manage our cybersecurity risk as an integral part of our enterprise risk management programs. Accordingly, the disclosures in this Item 1C should be reviewed in conjunction with the disclosure in the Risk Management section in Item 7 of this Report.

companyName: PNC FINANCIAL SERVICES GROUP, INC.

ticker: PNC

secItem: Item 1C


text: Information Security Program PNC's approach to cyber risk management, oversight and reporting is based on a well-structured information security program. The program is responsible for protecting information assets to achieve business objectives in a secure manner and designed to keep customers' information and their funds safe and available. Program capabilities are built against industry guidance and a security framework to identify risks to sensitive information, protect that information and maintain an appropriate response and recovery capability to help ensure resilience against information security incidents.


text: PNC's information security program is designed to ensure that PNC follows industry guidance and security frameworks for data protection, system development security, identity and access management, incident management, threat and vulnerability management, security operations management and third- and fourth-party security. Our program is continuously enhanced by threat intelligence, new regulations, industry guidance and disruptive new technologies. The program includes, among other things, annual security and privacy training for all PNC employees, phishing exercises, and informative articles and communications to raise employee awareness.


text: PNC actively monitors and responds to the overall cybersecurity threat landscape via active capabilities to share information and leverage intelligence, monitoring, and response capabilities across the security industry, which include cybersecurity threats, physical threats and fraud. PNC's intelligence and analysis capabilities collaborate to analyze events and trends for possible response.


text: We have not experienced any material cybersecurity incidents that have impacted PNC's business strategy, results of operations or financial condition to date. Notwithstanding our approach regarding cybersecurity, we may not be successful in preventing or mitigating the impact of a cybersecurity incident that could have a material impact on our business, results of operations or financial condition. See Item 1A Risk Factors of this Report for a discussion of cybersecurity risks.


text: Board Governance and Risk Oversight PNC's Board of Directors maintains governance and oversight of the risks posed by cybersecurity threats through the Board-level Technology and Risk Committees.


text: The Technology Committee meets no less than quarterly, and its purpose is to (i) assist the Board with the oversight of technology strategy and significant technology initiatives and programs, including those that can position the use of technology to drive strategic advantages and (ii) fulfill oversight responsibilities with respect to technology risk, information management and security risks (including cyber security, cyber fraud and physical security risks), and the adequacy of PNC's business recovery, resiliency and contingency plans and test results.


text: The Technology Committee is informed of cyber threats and risks through multiple mechanisms. PNC's Chief Information Security Officer presents quarterly to the Technology Committee on such topics as threat intelligence and assessment reports, incident and event reporting from other institutions, governance and regulatory exam statuses, and the status of other key program deliverables, among other content.


text: The Risk Committee meets no less than quarterly and provides oversight of PNC's ERM framework. Cybersecurity risk is integrated into PNC's overall ERM framework, and is represented as the Information Security domain, alongside seven other operational risk domains. See the Risk Management section in Item 7 of this Report for more details on our ERM framework.


text: PNC's inherent information security risks, the maturity and completeness of the control environment and measurements against our risk appetite are presented quarterly to the Technology Committee by the firm's Chief Technology Risk Officer. Overall risks across the Enterprise Risk Framework are then reported quarterly to the Risk Committee by the Chief Risk Officer.


text: Communication to the Board occurs more frequently than quarterly when dictated by incident and event management policies and procedures based on the criticality and urgency of the communication.


text: Role of Management Management is directly involved in assessing and managing PNC's risks from cybersecurity threats. PNC uses a three-lines-of-defense model where cybersecurity risk is managed and assessed by the first line of defense, led by the Chief Information Security Officer and the Director of Technology and Security Risk Management, and the second line of defense which is led by the Chief Technology Risk Officer, who reports to the Chief Risk Officer. The first and second lines of defense are examined internally by our third line of defense, Internal Audit. The lines of defense model is designed to ensure appropriate oversight within the management structure. See the Risk Governance and Oversight section of Risk Management for more details on each of our lines of defense. In addition to the three lines of internal defense, PNC engages external consultants to assess and inform the program, as needed.


text: The Chief Information Security Officer's organization includes managers who have led cybersecurity programs in other industries such as robotics and AI, consulting, telecommunications, healthcare and manufacturing, which brings together a multi-faceted approach to managing cybersecurity threats and risks. The Information Security department leadership and personnel hold degrees in Information Security, Management Information Systems, Computer Science, Engineering Management and other professional majors. They also hold multiple professional certifications inclusive of vendor-issued security credentials from CISCO, Microsoft and F5, and industry certifications including but not limited to: Certified Information Systems Security Professional issued by the International Information System Security Certification Consortium; the Cybersecurity and Infrastructure Security Agency and Certified Information Security Manager issued by the Information Systems Audit and Control Association; and the Certificate of Cloud Security Knowledge issued by the Cloud Security Association.


text: Cyber Risks Related to Third Parties Risks from cybersecurity threats associated with its use of third-party service providers are addressed as part of the information security risk and third-party risk domains, and their management is integrated into the ERM Framework. To help control cyber risks at third parties and protect customer data and systems, PNC assesses suppliers and third parties through a third-party security program that includes periodic security assessment. The third-party security program also includes regular monitoring of certain third parties using an independent security rating service that is designed to ensure insight and alerting is available at scale. In the event of an incident at a third party, there are specific incident response processes and protocols in place that are designed to protect PNC from potential adverse impacts.


text: We have an enterprise-wide information security program designed to provide controls, technologies and other processes to identify, assess and manage material cyber and information security risks and threats. Our information security program leverages the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover.

companyName: VALLEY NATIONAL BANCORP

ticker: VLY


text: The Board has primary oversight responsibility for our cyber and information security risk as a key part of its oversight of Valley's enterprise-wide risk management (ERM) framework, and we employ personnel dedicated to assisting the Board in fulfilling this oversight responsibility. As a general matter, Valley seeks to address cyber and information security risks through a cross-functional approach, as described below, that is focused on identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur. Our information security team reviews ERM-level cybersecurity risks annually, and key cybersecurity risks are incorporated into the ERM framework, which is periodically reviewed by management throughout the year at its Executive Risk Committee.


text: As part of this framework, we have a set of enterprise-wide policies and procedures concerning cybersecurity matters which go through an internal review process and are approved by appropriate members of senior management or the Board, which include an Information Security Policy, as well as other policies and procedures that directly or indirectly relate to cybersecurity, and practices related to encryption, antivirus protection, remote access, multi factor authentication, the protection of confidential information and the use of the internet, social media, email, and wireless devices.


text: Having the appropriate governance structure in place is critical to the functioning of our cyber and information security risk framework. As noted above, our Board has primary oversight responsibility for our cyber and information security risk, and it performs this oversight function primarily through its Risk Committee, which reports to the full Board. Additionally, to keep pace with the speed of disruptive innovation and associated cyber risks, the Board has established a dedicated Cyber & Technology Risk Subcommittee (the "Cyber Subcommittee") that reports to the Risk Committee. The Risk Committee, through the Cyber Subcommittee, oversees the Company's cybersecurity risk profile, prevalent cybersecurity risks, our enterprise information security program and key enterprise information security initiatives.


text: We also have a team of employees, including at the senior management level, who are dedicated to assisting the Board in fulfilling its oversight responsibility for cyber and information security. Valley's Chief Information Security Officer (CISO), who is responsible for developing and implementing our cyber and information security program, has over 23 years of experience leading cyber security oversight and holds a Certified in Risk and Information Systems Controls certification, and others on our information security team have cybersecurity experience or certifications. The CISO and Director of Cyber Risk Management, both of whom participate in all meetings of the Cyber Subcommittee, contribute over 60 years collectively of expertise in cyber and information security across industries and at some of the world's largest banks and at various technology firms.


text: Our Board, through the Risk Committee and the Cyber Subcommittee, receives regular updates and reporting from management on cyber and information security matters, including information related to third-party assessments of Valley's information security program, as well as a wide range of topics such as recent developments, evolving standards, Valley's vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to Valley's peers and third parties. On an annual basis, the Board and its Risk Committee discuss Valley's approach to cyber and information security risk management. Senior management is briefed by our information security team on cyber and information security matters, preparedness and any incidents requiring the attention of our security incident response team.


text: Our cyber and information security risk management framework and strategy is focused on the following key areas:


text: Identification, Protection and Detection. Valley maintains a threat team and internal committees to identify any new threats and risks to its information systems. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile through various methods including, for example, using manual and automated tools, subscribing to threat intelligence reports and services, analyzing threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and conducting threat and vulnerability assessments.


text: Technical Safeguards. Valley also deploys technical safeguards that are designed to protect Valley's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, continuous scanning of our environments for potential weaknesses, behavioral-based protections against malware and filtering of inbound emails to protect the firm against phishing attacks. The effectiveness of these safeguards is evaluated through vulnerability assessments and cybersecurity threat intelligence with the goal of implementing improvements as needed.


text: Valley maintains a risk-based approach to identifying and overseeing cybersecurity risks presented by vendors, service providers and other third parties, as well as the systems of third parties that could adversely impact its business in the event of a cybersecurity incident affecting those third-party systems. We have integrated security reviews into the third-party vendor management program. We assess third-party cybersecurity controls and include security and privacy provisions in our contracts where applicable. However, ultimately, we rely on the third parties we use to implement information security programs commensurate with the relevant risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: Education and Awareness. Valley provides mandatory cybersecurity training at least annually for all employees, which is intended to equip them with tools to identify and address cybersecurity threats, and to communicate Valley's evolving information security policies, standards, processes and practices. We also require employees in certain roles to complete additional role-based, specialized cyber and information security training.


text: Valley maintains incident response and recovery plans that are intended to assist in Valley's response to a cyber or information security incident, and such plans are evaluated on a regular basis. In the event of an incident, we intend to follow our incident response plan, which outlines the steps to be followed from incident detection to eradication, recovery and notification, including notifying functional areas (e.g., legal), as well as senior management and the Board, as appropriate. As part of these plans, we have also implemented controls and procedures providing for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents, including to regulators and governmental agencies, can be made by management in a timely manner.


text: Outside Consultants. While we have deployed personnel to perform testing and oversight functions internally, we also leverage external consultants and other tools to test the effectiveness of our operating environment and the protection of our data. We engage third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and reviews of our information security control environment and operating effectiveness. These assessment efforts include a wide range of activities such as tabletop exercises, vulnerability testing, and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The results of these assessments are reported to the Risk Committee and the Board. Valley adjusts its cyber and information security program as necessary based on the information provided by these assessments, audits and reviews.


text: Impact of Cybersecurity Threats We are regularly subject to cybersecurity attacks. Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not, to date, materially affected or are reasonably likely to affect Valley, including our business strategy, results of operations or financial condition. Notwithstanding the comprehensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For more information, see Item 1A. Risk Factors for further information about these risks.


text: We also have a team of employees, including at the senior management level, who are dedicated to assisting the Board in fulfilling its oversight responsibility for cyber and information security. Valley's Chief Information Security Officer (CISO), who is responsible for developing and implementing our cyber and information security program, has over 24 years of experience leading cyber security oversight and holds a CRISC certification, and others on our information security team have cybersecurity experience or certifications. The CISO and Director of Cyber Risk Management each participate in all meetings of the Cyber Subcommittee.


text: Our enterprise risk management program is designed to identify, assess, and mitigate risks across various aspects of our company, including financial, operational, regulatory, reputational, and legal. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential of cyber threats. Our processes and policies related to cybersecurity are focused on: (i) developing organizational understanding to manage cybersecurity risks, (ii) applying safeguards to protect our systems, (iii) detecting the occurrence of a cybersecurity incident, (iv) responding to a cybersecurity incident, and (v) recovering from a cybersecurity incident. Where appropriate, these processes and policies are integrated into our overall enterprise risk management systems and processes. For example, all of our employees with network access are required to complete information security and privacy training on an annual basis. We are continuously working to improve our information technology systems and provide employee awareness training around phishing, malware, and other cyber risks to enhance our levels of protection.

companyName: GERMAN AMERICAN BANCORP, INC.

ticker: GABC


text: Other aspects of our cyber and information security risk management program include: • Monitoring external and internal threats and events, managing access, facilitating use of appropriate authentication options, validating controls and programs by internal teams and independent third parties and testing various compromise scenarios that are overseen by our information security team; • Investing in threat intelligence platforms and participating in financial services industry and government forums which track and report on cyber and other information security threats; • Identifying those third-party relationships that have the greatest potential to expose the Company to cybersecurity threats and, upon identification, conducting additional due diligence as a part of establishing those relationships; • Routinely performing vulnerability tests; • Engaging independent consultants and other third-parties to assist the Company in establishing and improving its policies; and • Conducting "tabletop" exercises with outside consultants at least annually to test the Company's processes and policies and using feedback from those exercises to further improve our processes. The Company also maintains insurance coverage for cybersecurity incidents as part of its overall insurance portfolio.


text: In the event of a cybersecurity incident, the Company maintains incident response plans to investigate, classify, respond to, and manage cybersecurity incidents that may compromise the availability or integrity of our information systems, network resources, or data. In accordance with the incident response plans, cross-functional management teams assess and assign a threat level to each cybersecurity incident. A cybersecurity incident (or incidents, if aggregated together) assigned a critical threat level is escalated to a committee consisting of the Company's executive and certain other officers (for such purpose, the "Critical Threat Committee") for review.


text: The Company has not experienced any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including its business strategy, results of operations, or financial condition. However, cybersecurity attacks and other threats to the systems, networks, products and services of the Company, its customers and vendors, and other third parties could materially affect the Company in the future. See Item 1A. Risk Factors – Unauthorized disclosure of sensitive or confidential client or customer information, whether through a cyber-attack, other breach of our computer systems or otherwise, could harm our business.


text: In exercising oversight over the Company's information technology risks, including its cyber and information security program, our Board of Directors has established a Technology Committee that is led by the Company's Chief Digital and Information Officer ("CDIO") and is comprised of directors with technology industry backgrounds, all of the Company's executive officers, the Company's Information Security Officer ("ISO") and the Company's Chief Risk Officer. The Technology Committee receives materials on a quarterly basis to address the identification and status of information technology cybersecurity risks. Each year, the full Board of Directors also receives a comprehensive update on the Company's cyber and information security program.


text: Our CDIO leads the Company's digital optimization and information technology initiatives. He is also responsible for driving the strategy, execution and integration of all banking and nonbanking technology, information and digital initiatives in alignment with the Company's corporate business strategy. Our CDIO assumed his current role in January, 2022. Prior to that, he served as the Company's Senior Vice President of Technology and Operations, where he lead the Company's core processing and operations functions, and the development of technology-driven products and services. Our CDIO has over 20 years of technology and operations experience in the banking industry.


text: Our ISO oversees a team of employees dedicated to the prevention, detection, mitigation, and remediation of cybersecurity incidents. He joined the Company in September, 2022 with more than 20 years of technology and information security experience in banking and as a consultant, and holds a Certified Information Security Manager certification.


text: The Company's Critical Threat Committee is responsible for evaluating the materiality of a cybersecurity incident based on criteria that has been reviewed with the Board of Directors, and for determining whether there are disclosure obligations under applicable securities laws. In the event that the Critical Threat Committee determines that a critical cybersecurity incident (or incidents, if aggregated together) is deemed to be material, the Critical Threat Committee will brief the Board of Directors and oversee the disclosure process. For all critical cybersecurity incidents that are not deemed to be material, the Critical Threat Committee will notify the Company's Chairman and Chief Executive Officer to determine whether the Board of Directors will be notified of the critical incident during the next regularly-scheduled cybersecurity update to the Audit Committee, or sooner as circumstances warrant.


text: Our CDIO leads the Company's digital optimization and information technology initiatives. He is also responsible for driving the strategy, execution and integration of all banking and nonbanking technology, information and digital initiatives in alignment with the Company's corporate business strategy. Our CDIO assumed his current role in January 2022. Prior to that, he served as the Company's Senior Vice President of Technology and Operations, where he lead the Company's core processing and operations functions, and the development of technology-driven products and services. Our CDIO has over 20 years of technology and operations experience in the banking industry.


text: Our ISO oversees a team of employees dedicated to the prevention, detection, mitigation, and remediation of cybersecurity incidents. He joined the Company in September 2022 with more than 20 years of technology and information security experience in banking and as a consultant, and he holds a Certified Information Security Manager certification. The team of employees includes information security professionals with a range of varying cybersecurity education and experience, many of whom have substantial experience assessing and managing cybersecurity initiatives and hold various cybersecurity certifications.


text: Risk Management and Strategy General. The Company's information security program, including its processes with respect to cybersecurity, is focused on protecting our systems, networks and data from unauthorized access by a third party. Concerns about cybersecurity risks impact, at some level, every facet of the Company's operations, from the way we structure the services we offer, to how we communicate with our customers, to our interactions with and training of employees, and to the expenditures we make when expanding and enhancing our technological infrastructure. We expect this continue to be the case as cybersecurity threats, and the means to respond to those threats, continue to evolve.

companyName: RENASANT CORP

ticker: RNST


text: The Company has adopted a defense-in-depth philosophy that relies on multiple systems and processes to reasonably provide for the confidentiality, integrity and availability of our systems, networks and data. Features of our information security include: • Documentation: We have written policies and procedures that delineate the roles and responsibilities of the Company's Board of Directors, executive management and other employees, as well as outside parties, with respect to the various aspects of the information security program. This documentation helps to align the entire information security program with our efforts to maintain the integrity of the Company's cybersecurity. These policies and procedures are reviewed and updated at least annually. • Separation of duties: Separation of duties means that, where appropriate, a task is designed to ensure that more than one person or group is responsible for its completion. We believe that separation of duties helps to prevent fraud, misuse or other security compromise, and we apply this concept when we delegate administrative and oversight responsibilities to multiple groups for certain aspects of the information security program, including identity and access management, network management, system administration, policy oversight, monitoring and alerting. • The principle of least privilege: Access approval for the Company's employees is coordinated between an employee's manager, the Company's human resources department and the information systems administrator. The goal is to give an employee access rights to our data, applications and other information resources only to the extent necessary for the employee to perform the functions of the particular job. Any change in employment responsibilities that requires access changes is implemented using the same access approval procedures. Finally, all remote access into the Company's networks must include approval by the Chief Information Security Officer (which we refer to as the "CISO"). • Vulnerability and patch management: The Company's vulnerability management program includes internal and external scanning using third-party tools and services. Software patches are deployed based on criticality of vulnerability. Further, we track our performance in implementing patches, and if implementation timing falls below performance expectations, management will take steps to identify and remediate the root causes of implementation delays. • Risk assessments: At least annually, management conducts risk assessments to assess the existence, severity and trends of cybersecurity risks and other risks that the Company's information security program faces. The scope of an individual risk assessment can be the whole organization, parts of the organization, an individual information system, specific system components, or services. • Log management: System security logs are consolidated by the Company's Security Incident and Event Management system and are reviewed via both automatic and manual processes for anomalous behavior. • Incident response: The incident response process is designed to, among other things, promptly elevate a cybersecurity threat or incident to the parties responsible for leading our efforts to identify, contain and mitigate the threat or incident, notify impacted customers or other third parties and comply with applicable law, regulations and regulatory expectations.


text: • Employee training: Information security is an integral component of our employee training program. Training includes efforts to maintain security awareness among employees at all times by means of company-wide communications of cybersecurity risks or incidents affecting third parties, internal testing and similar efforts.


text: The information security program applies to all of the Company's business lines and employees as well as to vendors and other third parties with access to the Company's information systems or its confidential and proprietary information. Whenever we consider a new product or service to offer to its clients, or a new means of offering or providing an existing product or service, or a new back-office process or procedure, the implications to the Company's information security are required to be considered.


text: Our CISO, a Certified Information Systems Security Professional, leads the Company's information security team, which has over 50 years' combined experience in providing solutions to manage information security, compliance, privacy and technology management. The Board of Directors' Technology Committee and its Enterprise Risk Management Committee oversee our information security team, receiving regular updates related to the material features of the information security program, our success and failures in maintaining information security and emerging threats and management's proposed response thereto.


text: As mentioned above, the Company employs a layered, defense-in-depth approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block and provide alerts regarding suspicious activity and to report on any suspected threats. These controls include appropriate access controls based on least privilege, multifactor authentication for remote and privilege access, and encryption to protect data. The information security program is designed to comply with applicable laws and regulations and is driven by industry standards for financial institutions, including the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, as well as by the guidance promulgated by the National Institute of Standards and Technology ("NIST"). We work closely with government and industry associations to stay abreast of developments and share best practices with respect to cybersecurity. The following paragraphs describe how we test, or otherwise obtain feedback about, the Company's cybersecurity and other information security. The feedback we develop through testing and assessment, in addition to information about cybersecurity threats or incidents impacting other entities, is incorporated into the Company's information security program to enhance our cybersecurity; in certain circumstances a new or emerging cybersecurity threat may require modifications to how we conduct business.


text: The Company's information security team utilizes the Financial Services Sector Coordinating Council for Critical Infrastructure Protection and Homeland Security version of the FFIEC Cybersecurity Assessment Tool to perform an annual assessment of our information security program. The assessment provides a repeatable and measurable process for institutions to measure their cybersecurity preparedness over time. The assessment incorporates cybersecurity-related principles from the FFIEC Information Technology Examination Handbook and regulatory guidance, and concepts from other industry standards, including the NIST Cybersecurity Framework.


text: The assessment consists of two parts: Inherent Risk Profile and Cybersecurity Maturity. The Cybersecurity Maturity aspect of the assessment is designed to help management measure the institution's level of risk and corresponding controls. The levels range from baseline to innovative. Cybersecurity Maturity includes tests to determine whether an institution's behaviors, practices and processes can support cybersecurity preparedness within the following five domains: • Cyber risk management and oversight • Threat intelligence and collaboration • Cybersecurity controls • External dependency management • Cyber incident management and resilience We also retain third parties to test the effectiveness of our cybersecurity efforts. Annually, we obtain independent third party audits of the information security program, including program maturity and overall control effectiveness. In addition, multiple times over the course of each year we engage third party security firms to conduct both external and internal penetration tests. The goal of these assessments is to discover vulnerabilities in the Company's in-scope corporate networks. When testing reveals potential vulnerabilities in the Company's security, management works to develop appropriate mitigation plans to resolve any outstanding issues; we also consider other recommendations to enhance our cybersecurity that these security firms may offer, implementing those that management concludes are appropriate within the context of the Company's information security program and processes. In addition to audits and testing by third party security firms, our information security program and infrastructure is subject to continuous supervision by the FDIC and the DBCF, including an annual in-depth examination by subject-matter experts from the FDIC and DBCF. The laws and regulations that these regulators administer impose very high expectations on the Company with respect to its information security policies, procedures, processes and controls. In particular, the Interagency Guidelines Establishing Information Security Standards (the "Guidelines") require us to implement a comprehensive written information security program that includes administrative, technical and physical safeguards designed to (1) ensure the security and confidentiality of customer information; (2) protect against any anticipated threats or hazards to the security or integrity of such information; (3) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer; and (4) ensure the proper disposal of customer information and consumer information. We also must comply with the information sharing requirements and restrictions enacted pursuant to the GLBA. The regulators' continuous supervision of the Company is designed to ensure, among other things, that our information security program meets all the standards set forth in the Guidelines and that we operate in compliance with the GLBA and all other applicable information security laws and regulations. Finally, in addition to external scrutiny, our internal audit department reviews our compliance with the Guidelines, the GLBA and other laws and regulations, including those related to information security. If any of these examinations identify deficiencies or areas for improvement, the Company's information security team works with management to act as promptly as reasonably possible to address the action item resulting from any such examination or review.


text: Diligence of Vendors and Other Third Parties. As noted above, the Company's information security program applies to our vendors and other third parties (referred to collectively as "vendors") with access to our information systems and networks and/or confidential and proprietary information. Before we grant access to the Company's systems or a vendor otherwise obtains access to the Company's confidential and proprietary information, our information security team assesses the vendor's information security program. We review the vendor's information security policy (to the extent the third party is willing to provide a copy of such policy), information security audits, service organization reports and similar information as well as examination reports of the vendor if available from the banking regulators or other governmental entities; the team will also investigate the background, reputation and history of prior cybersecurity incidents of such vendor or other third party. If the information security team is not satisfied that the vendor's information security infrastructure is adequate to reasonably protect the Company's systems and confidential and proprietary information from unauthorized access, and there are no suitable solution to address the information security team's concerns, then we will not engage such vendor.


text: The vendors we retain are also categorized by the level of risk that the vendor presents to us, of which information security risk is a component. The information security team annually reviews those vendors in the "high risk" category and periodically reviews other vendors. This review includes obtaining updated information security audits and service organization reports, where available, and otherwise analyzing whether the vendor's cybersecurity risk profile has materially changed.


text: The information security team's review process does not, and cannot, guarantee that a Company vendor will not suffer a cybersecurity incident that impacts us. Due to the possibility that a vendor's information security may be breached, we also negotiate provisions in vendor contracts that address cybersecurity incidents. In addition to including provisions that address the parties' relative responsibility for damages resulting from a cybersecurity incident at a vendor, these contracts also typically include provisions to ensure that the Company receives timely and complete notification of a cybersecurity incident and cooperation in responding thereto so that we can assess the extent of the incident's impact on the Company's systems or information, mitigate any adverse effects arising therefrom and comply with any customer or regulation notification requirements and other legal, regulator or contractual obligations.


text: For those situations where a cybersecurity threat or incident arises, whether internal to the Company or relating to one of its vendors, we have also organized an incident response team. The incident response team includes representatives from the information technology, operations, risk management, legal (including securities law counsel), privacy and finance departments, among others. In addition to meeting quarterly, the incident response team (or a subset of the team) gathers whenever there is a threatened or actual breach of the Company's information security (whether involving an external actor or an internal party) to determine the nature and extent of the threatened or actual breach and, if appropriate, the steps to take in response thereto to protect the Company's information security and mitigate any harm that has already occurred. The team is also responsible for ensuring the Company complies with legal and regulatory requirements (including notifying affected customers and regulators and making any filings required by the securities laws). The activities of our incident response team are reported to the Board's Enterprise Risk Management Committee. The Company also maintains a cyber insurance policy that provides cyber liability coverage.


text: Employee Training and Security Awareness. All employees are required to complete an annual security awareness training program. Courses within the training program include general cybersecurity best practices as well as a course specifically related to social engineering, email and social media security. The Company also conducts routine internally-focused exercises to help raise employee awareness of the risks associated with cybersecurity. For example, over the course of 2023, employees received at least one email per quarter designed to test employees' ability to identify and avoid potential "phishing" emails, and those employees that fail this phishing test are assigned additional training. In addition, annually the Company's incident response team engages in a cyber attack tabletop exercise designed by the Financial Services Information Sharing and Analysis Center that helps to train the incident response team in overcoming a simulated attack against Renasant's payment systems and processes.


text: The Company takes a layered approach to the governance of its cybersecurity risk management. The first line of defense against cybersecurity risk is the company's information security team, led by the CISO. This team is primarily responsible for promptly identifying cybersecurity risks associated with our existing and anticipated operations and, once identified, assessing as to the level that each cybersecurity risk poses to us, and then controlling or mitigating to the extent reasonably possible (in the context the Company's operations and resources, and competitive factors affecting how banks and other financial services companies conduct operations, among other things).


text: The efforts of our information security team to address cybersecurity risk are reviewed by the Company's Risk Department, which oversees our enterprise risk management program. The department focuses on the quality of the Company's risk management process in order to manage risks within acceptable tolerance levels. As it pertains to cybersecurity risk, the Risk Department challenges the processes that the information security team has implemented to identify, assess, control and mitigate cybersecurity risk. The department collaborates with the CISO and other business unit owners impacted by our cybersecurity risk management practices to develop and monitor controls and other processes that mitigate identified risks. In addition, the Risk Department conducts independent risk evaluations related to cybersecurity risk.


text: The primary means by which the Risk Department evaluates cybersecurity risk is the development, in conjunction with the information security team, of risk metrics related to cybersecurity as well as risk tolerances with respect to each such metric. Risk tolerances are set such that the overall cybersecurity risk presented to us is consistent with the risk appetite statement adopted by our Board annually. Management believes these metrics provide a holistic picture of the Company's cybersecurity risk profile, but at the same time, we recognize that, given the continual evolution of cybersecurity risks, including the tools and vectors that bad actors take to compromise a company's information security, our risk metrics cannot remain static. At least annually, the Risk Department meets with the CISO to assess whether the risk metrics, and the tolerances for each metric, remain appropriate in light of the Company's operations and the cybersecurity threat environment.


text: As the third line of defense against cybersecurity risk, our Internal Audit Department, with the assistance of outside experts, annually reviews and tests the Company's processes, including its policies, procedures and controls, with respect to cybersecurity risk. The Internal Audit Department reports the results of its review, including the steps management intends to take to address any findings, to the Audit Committee of the Board of Directors.


text: Finally, as a means to ensure that our senior executive management has an integrated understanding of the cybersecurity and other risks facing the company at any particular time, the Company has organized a Management Enterprise Risk Management Committee (the "management ERM committee"). Our Chief Risk Officer leads this committee, whose membership includes the Company's President and the leaders of our major business lines and back-office functions. Among other things, the management ERM committee reviews the Company's cybersecurity and other risk metrics and the direction in which each risk is trending (increasing risk or decreasing risk), both in isolation and in the context of other existing and emerging risks facing the company, and the status of risk mitigants therefor. We believe that this committee helps management better focus its efforts to minimize cybersecurity risk and that it assists in more focused reporting of cybersecurity risks to the Board of Directors.


text: The Company's Board of Directors primarily oversees the risks related to our technological infrastructure, information security, cybersecurity, business continuity and disaster recovery programs through its Technology Committee and its Enterprise Risk Management Committee (the "ERM Committee"). These committees meet quarterly, and their activities are reported to the full Board of Directors.


text: The Technology Committee is responsible for the oversight of Renasant's strategies and operations with respect to information technology. Although this committee's focus is broader than just information security and cybersecurity risk, at each meeting the CISO reports to the committee on, among other topics, the status of any cybersecurity and network security initiatives designed to enhance the Company's cybersecurity, emerging cybersecurity risks that may not yet be addressed by the existing risk metrics and management's plans to mitigate such risks, and employee training on cybersecurity and related issues.


text: The ERM Committee incorporates the assessment, monitoring and mitigation of cybersecurity risk into its monitoring of the Company's broader enterprise risk management function. At each meeting of the ERM Committee, the Chief Risk Officer reports on the status within established tolerances of each risk metric as well as the assessment of the direction such metric is trending. These metric reports give the ERM Committee a broad view of the aggregate cybersecurity risk that the Company faces at any particular time, insight into any particular areas of risk as well as an opportunity for the ERM Committee to discuss with management the steps taken or to be taken to address risks that are out of tolerance or trending in that direction. In addition to this report, the CISO's report to the Technology Committee is included the materials for ERM meetings. The chair of the Technology Committee is a member of the ERM Committee, enabling the chair to convey to the ERM Committee details of the discussions with respect to the CISO's report as well as other matters related to our technological infrastructure and the impact thereof on matters within the ERM Committee's focus. Finally, at each ERM Committee meeting our Chief Technology Officer addresses various information technology topics with the ERM Committee.


text: Risk Management and Strategy General. The Company's information security program, including its processes with respect to cybersecurity, is focused on protecting our systems, networks and data from unauthorized access by a third party. Concerns about cybersecurity risks impact, at some level, every facet of the Company's operations, from the way we structure the services we offer, to how we communicate with our customers, to our interactions with and training of employees, and to the expenditures we make when expanding and enhancing our technological infrastructure. We expect this continue to be the case as cybersecurity threats, and the means to respond to those threats, continue to evolve.


text: The Company has adopted a defense-in-depth philosophy that relies on multiple systems and processes to reasonably provide for the confidentiality, integrity and availability of our systems, networks and data. Features of our information security include: • Documentation: We have written policies and procedures that delineate the roles and responsibilities of the Company's Board of Directors, executive management and other employees, as well as outside parties, with respect to the various aspects of the information security program. This documentation helps to align the entire information security program with our efforts to maintain the integrity of the Company's cybersecurity. These policies and procedures are reviewed and updated at least annually. • Separation of duties: Separation of duties means that, where appropriate, a task is designed to ensure that more than one person or group is responsible for its completion. We believe that separation of duties helps to prevent fraud, misuse or other security compromise, and we apply this concept when we delegate administrative and oversight responsibilities to multiple groups for certain aspects of the information security program, including identity and access management, network management, system administration, policy oversight, monitoring and alerting. • The principle of least privilege: Access approval for the Company's employees is coordinated between an employee's manager, the Company's human resources department and the information systems administrator. The goal is to give an employee access rights to our data, applications and other information resources only to the extent necessary for the employee to perform the functions of the particular job. Any change in employment responsibilities that requires access changes is implemented using the same access approval procedures. Finally, all remote access into the Company's networks must be approved by the Chief Information Security Officer (which we refer to as the "CISO"). • Vulnerability and patch management: The Company's vulnerability management program includes internal and external scanning using third-party tools and services. Software patches are deployed based on criticality of vulnerability. Further, we track our performance in implementing patches, and if implementation timing falls below performance expectations, management will take steps to identify and remediate the root causes of implementation delays. • Risk assessments: At least annually, management conducts risk assessments to assess the existence, severity and trends of cybersecurity risks and other risks that the Company's information security program faces. The scope of an individual risk assessment can be the whole organization, parts of the organization, an individual information system, specific system components, or services. • Log management: System security logs are consolidated by the Company's Security Incident and Event Management system and are reviewed via both automatic and manual processes for anomalous behavior. • Incident response: The incident response process is designed to, among other things, promptly elevate a cybersecurity threat or incident to the parties responsible for leading our efforts to identify, contain and mitigate the threat or incident, notify impacted customers or other third parties and comply with applicable law, regulations and regulatory expectations.


text: • Employee training: Information security is an integral component of our employee training program. Training includes efforts to maintain security awareness among employees at all times by means of company-wide communications of cybersecurity risks or incidents affecting third parties, internal testing and similar efforts.


text: The information security program applies to all of the Company's business lines and employees as well as to vendors and other third parties with access to the Company's information systems or its confidential and proprietary information. Whenever we consider a new product or service to offer to our clients, or a new means of offering or providing an existing product or service, or a new back-office process or procedure, the implications to the Company's information security are required to be considered.


text: Our CISO, a Certified Information Systems Security Professional, leads the Company's information security team, which has over 50 years' combined experience in providing solutions to manage information security, compliance, privacy and technology management. The Board of Directors' Technology Committee and its Enterprise Risk Management Committee (the "ERM Committee") oversee our information security team, receiving regular updates related to the material features of the information security program, our success and failures in maintaining information security and emerging threats and management's proposed response thereto.


text: As mentioned above, the Company employs a layered, defense-in-depth approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block and provide alerts regarding suspicious activity and to report on any suspected threats. These controls include appropriate access controls based on least privilege, multifactor authentication for remote and privilege access, and encryption to protect data. The information security program is designed to comply with applicable laws and regulations and is driven by industry standards for financial institutions, including the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool, as well as by the guidance promulgated by the National Institute of Standards and Technology ("NIST"). We work closely with government and industry associations to stay abreast of developments and share best practices with respect to cybersecurity. The following paragraphs describe how we test, or otherwise obtain feedback about, the Company's cybersecurity and other information security. The feedback we develop through testing and assessment, in addition to information about cybersecurity threats or incidents impacting other entities, is incorporated into the Company's information security program to enhance our cybersecurity; in certain circumstances a new or emerging cybersecurity threat may require modifications to how we conduct business.


text: The Company's information security team utilizes the Financial Services Sector Coordinating Council for Critical Infrastructure Protection and Homeland Security version of the FFIEC Cybersecurity Assessment Tool to perform an annual assessment of our information security program. The assessment provides a repeatable and measurable process for institutions to measure their cybersecurity preparedness over time. The assessment incorporates cybersecurity-related principles from the FFIEC Information Technology Examination Handbook and regulatory guidance, and concepts from other industry standards, including the NIST Cybersecurity Framework.


text: The assessment consists of two parts: Inherent Risk Profile and Cybersecurity Maturity. The Cybersecurity Maturity aspect of the assessment is designed to help management measure the institution's level of risk and corresponding controls. The levels range from baseline to innovative. Cybersecurity Maturity includes tests to determine whether an institution's behaviors, practices and processes can support cybersecurity preparedness within the following five domains: • Cyber risk management and oversight • Threat intelligence and collaboration • Cybersecurity controls • External dependency management • Cyber incident management and resilience We also retain third parties to test the effectiveness of our cybersecurity efforts. Annually, we obtain independent third party audits of the information security program, including program maturity and overall control effectiveness. In addition, multiple times over the course of each year we engage third party security firms to conduct both external and internal penetration tests. The goal of these assessments is to discover vulnerabilities in the Company's in-scope corporate networks. When testing reveals potential vulnerabilities in the Company's security, management works to develop appropriate mitigation plans to resolve any outstanding issues; we also consider other recommendations to enhance our cybersecurity that these security firms may offer, implementing those that management concludes are appropriate within the context of the Company's information security program and processes. In addition to audits and testing by third party security firms, our information security program and infrastructure is subject to continuous supervision by the FDIC and the DBCF, including an annual in-depth examination by subject-matter experts from the FDIC and DBCF. The laws and regulations that these regulators administer impose very high expectations on the Company with respect to its information security policies, procedures, processes and controls. In particular, the Interagency Guidelines Establishing Information Security Standards (the "Guidelines") require us to implement a comprehensive written information security program that includes administrative, technical and physical safeguards designed to (1) ensure the security and confidentiality of customer information; (2) protect against any anticipated threats or hazards to the security or integrity of such information; (3) protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer; and (4) ensure the proper disposal of customer information and consumer information. We also must comply with the information sharing requirements and restrictions enacted pursuant to the GLBA. The regulators' continuous supervision of the Company is designed to ensure, among other things, that our information security program meets all the standards set forth in the Guidelines and that we operate in compliance with the GLBA and all other applicable information security laws and regulations. Finally, in addition to external scrutiny, our internal audit department reviews our compliance with the Guidelines, the GLBA and other laws and regulations, including those related to information security. If any of these examinations identify deficiencies or areas for improvement, the Company's information security team works with management to act as promptly as reasonably possible to address the action item resulting from any such examination or review.


text: Diligence of Vendors and Other Third Parties. As noted above, the Company's information security program applies to our vendors and other third parties (referred to collectively as "vendors") with access to our information systems and networks and/or confidential and proprietary information. Before we grant access to the Company's systems or a vendor otherwise obtains access to the Company's confidential and proprietary information, our information security team assesses the vendor's information security program. We review the vendor's information security policy (to the extent the third party is willing to provide a copy of such policy), information security audits, service organization reports and similar information as well as examination reports of the vendor if available from the banking regulators or other governmental entities; the team will also investigate the background, reputation and history of prior cybersecurity incidents of such vendor or other third party. If the information security team is not satisfied that the vendor's information security infrastructure is adequate to reasonably protect the Company's systems and confidential and proprietary information from unauthorized access, and there are no suitable solution to address the information security team's concerns, then we will not engage such vendor.


text: The vendors we retain are also categorized by the level of risk that the vendor presents to us, of which information security risk is a component. The information security team annually reviews those vendors in the "high risk" category and periodically reviews other vendors. This review includes obtaining updated information security audits and service organization reports, where available, and otherwise analyzing whether the vendor's cybersecurity risk profile has materially changed.


text: The information security team's review process does not, and cannot, guarantee that a Company vendor will not suffer a cybersecurity incident that impacts us. Due to the possibility that a vendor's information security may be breached, we also negotiate provisions in vendor contracts that address cybersecurity incidents. In addition to including provisions that address the parties' relative responsibility for damages resulting from a cybersecurity incident at a vendor, these contracts also typically include provisions to ensure that the Company receives timely and complete notification of a cybersecurity incident and cooperation in responding thereto so that we can assess the extent of the incident's impact on the Company's systems or information, mitigate any adverse effects arising therefrom and comply with any customer or regulation notification requirements and other legal, regulator or contractual obligations.


text: For those situations where a cybersecurity threat or incident arises, whether internal to the Company or relating to one of its vendors, we have also organized an incident response team. The incident response team includes representatives from the information technology, operations, risk management, legal (including securities law counsel), privacy and finance departments, among others. In addition to meeting quarterly, the incident response team (or a subset of the team) gathers whenever there is a threatened or actual breach of the Company's information security (whether involving an external actor or an internal party) to determine the nature and extent of the threatened or actual breach and, if appropriate, the steps to take in response thereto to protect the Company's information security and mitigate any harm that has already occurred. The team is also responsible for ensuring the Company complies with legal and regulatory requirements (including notifying affected customers and regulators and making any filings required by the securities laws). The activities of our incident response team are reported to the Board's Enterprise Risk Management Committee. The Company also maintains a cyber insurance policy that provides cyber liability coverage.


text: Employee Training and Security Awareness. All employees are required to complete an annual security awareness training program. Courses within the training program include general cybersecurity best practices as well as a course specifically related to social engineering, email and social media security. The Company also conducts routine internally-focused exercises to help raise employee awareness of the risks associated with cybersecurity. For example, over the course of 2024, employees received at least one email per quarter designed to test employees' ability to identify and avoid potential "phishing" emails, and those employees that fail this phishing test are assigned additional training. In addition, annually the Company's incident response team engages in a cyber attack tabletop exercise designed by the Financial Services Information Sharing and Analysis Center that helps to train the incident response team in overcoming a simulated attack against Renasant's payment systems and processes.


text: The Company takes a layered approach to the governance of its cybersecurity risk management. The first line of defense against cybersecurity risk is the company's information security team, led by the CISO. This team is primarily responsible for promptly identifying cybersecurity risks associated with our existing and anticipated operations and, once identified, assessing the level that each cybersecurity risk poses to us, and then controlling or mitigating to the extent reasonably possible (in the context of the Company's operations and resources, and competitive factors affecting how banks and other financial services companies conduct operations, among other things).


text: The efforts of our information security team to address cybersecurity risk are reviewed by the Company's Risk Department, which oversees our enterprise risk management program. The department focuses on the quality of the Company's risk management process in order to manage risks within acceptable tolerance levels. As it pertains to cybersecurity risk, the Risk Department challenges the processes that the information security team has implemented to identify, assess, control and mitigate cybersecurity risk. The department collaborates with the CISO and other business unit owners impacted by our cybersecurity risk management practices to develop and monitor controls and other processes that mitigate identified risks. In addition, the Risk Department conducts independent risk evaluations related to cybersecurity risk.


text: The primary means by which the Risk Department evaluates cybersecurity risk is the development, in conjunction with the information security team, of risk metrics related to cybersecurity as well as risk tolerances with respect to each such metric. Risk tolerances are set such that the overall cybersecurity risk presented to us is consistent with the risk appetite statement adopted by our Board annually. Management believes these metrics provide a holistic picture of the Company's cybersecurity risk profile, but at the same time, we recognize that, given the continual evolution of cybersecurity risks, including the tools and vectors that bad actors take to compromise a company's information security, our risk metrics cannot remain static. At least annually, the Risk Department meets with the CISO to assess whether the risk metrics, and the tolerances for each metric, remain appropriate in light of the Company's operations and the cybersecurity threat environment.


text: As the third line of defense against cybersecurity risk, our Internal Audit Department, with the assistance of outside experts, annually reviews and tests the Company's processes, including its policies, procedures and controls, with respect to cybersecurity risk. The Internal Audit Department reports the results of its review, including the steps management intends to take to address any findings, to the Audit Committee of the Board of Directors.


text: Finally, as a means to ensure that our senior executive management has an integrated understanding of the cybersecurity and other risks facing the company at any particular time, the Company has organized a Management Enterprise Risk Management Committee (the "management ERM committee"). Our Chief Risk Officer leads this committee, whose membership includes the Company's President and the leaders of our major business lines and back-office functions. Among other things, the management ERM committee reviews the Company's cybersecurity and other risk metrics and the direction in which each risk is trending (increasing risk or decreasing risk), both in isolation and in the context of other existing and emerging risks facing the company, and the status of risk mitigants therefor. We believe that this committee helps management better focus its efforts to minimize cybersecurity risk and that it assists in more focused reporting of cybersecurity risks to the Board of Directors.


text: The Company's Board of Directors primarily oversees the risks related to our technological infrastructure, information security, cybersecurity, business continuity and disaster recovery programs through its Technology Committee and the ERM Committee. These committees meet quarterly, and their activities are reported to the full Board of Directors.


text: The Technology Committee is responsible for the oversight of Renasant's strategies and operations with respect to information technology. Although this committee's focus is broader than just information security and cybersecurity risk, at each meeting the CISO reports to the committee on, among other topics, the status of any cybersecurity and network security initiatives designed to enhance the Company's cybersecurity, emerging cybersecurity risks that may not yet be addressed by the existing risk metrics and management's plans to mitigate such risks, and employee training on cybersecurity and related issues.


text: The ERM Committee incorporates the assessment, monitoring and mitigation of cybersecurity risk into its monitoring of the Company's broader enterprise risk management function. The Company tracks numerous risk metrics relating to cybersecurity, and at each meeting of the ERM Committee, the Chief Risk Officer reports on the status within established tolerances of each risk metric as well as the assessment of the metric's trend of increasing or decreasing risk. These metric reports give the ERM Committee a broad view of the aggregate cybersecurity risk that the Company faces at any particular time, insight into any particular areas of risk as well as an opportunity for the ERM Committee to discuss with management the steps taken or to be taken to address risks that are out of tolerance or trending in that direction. In addition to this report, the CISO's report to the Technology Committee described above is included the materials for ERM Committee meetings. The chair of the Technology Committee is a member of the ERM Committee, enabling the chair to convey to the ERM Committee details of the discussions with respect to the CISO's report as well as other matters related to our technological infrastructure and the impact thereof on matters within the ERM Committee's focus. Finally, the CISO attends ERM Committee meetings, providing additional detail, and answering committee members' questions, about the CISO's report.


text: ACNB recognizes the critical importance of identifying, assessing and managing material risks from cybersecurity threats and is committed to implementing and maintaining a comprehensive information security program to manage such risks and safeguard its systems and data. Governance of cybersecurity risk is based on the Corporation's Information Security Program and related policies and procedures, which are designed in conformance with industry standards and compliance with Section 39 of the Federal Deposit Insurance act and sections 501 and 505(b) of GLBA, and to protect the confidentiality, integrity and availability of its information assets. The Corporation's Board of Directors is responsible for overseeing the development, implementation and maintenance of the Corporation's overall information security standards. The Audit Committee of the Board of Directors has enterprise risk management oversight responsibilities, which includes information security. Information Security-related functions are performed by both ACNB Bank Risk Management and Technology Services personnel. The Information Security Committee is an ACNB Bank management committee which is responsible for providing oversight and direction for information security matters and standards and meets periodically throughout the year with minutes of their meetings provided to the Corporation's Board of Directors. ACNB Bank's Information Security Officer is responsible for managing and monitoring the Information Security Program, and is a part of the Risk Management department, which ultimately reports to the Chief Risk Officer. Additionally, the Information Security Program is supported by ACNB Bank's Technology Services Department which is led by the Technology Services Manager who reports to the Chief Credit and Operations Officer.

companyName: ACNB CORP

ticker: ACNB


text: The Information Security Program includes Information Security strategy, an incident response plan for incident management; access rights management; threat and vulnerability management; security training; risk and maturity assessments; security systems controls and standards; data use, reproduction, storage and destruction standards, intrusion prevention management, patch management, physical and environmental protections, encryption standards, malicious code prevention, intelligence sharing, and Information Security Monitoring, including architecture considerations, activity monitoring and condition monitoring. On an annual basis, Information Security-related risk assessments and a maturity analysis are performed and reported to the Board of Directors or the Board Audit Committee. Risks from cybersecurity threats associated with use of third-party service providers are addressed as part of the vendor management program, in initial and ongoing assessment of service providers. Information Security training is conducted for both employees and the Board of Directors annually. Training includes sharing educational communications to increase employee awareness of cybersecurity risks.


text: ACNB engages independent third-party assessors and auditors in connection with its information security program, including to conduct external and internal penetration testing and internal vulnerability scanning, independent audits and risk assessments. Technology Services personnel perform internal security practices, including periodic internal vulnerability scanning using commercial software tools and follow-up with corrective measures as required, monitoring for unauthorized access attempts, uses dynamically updated Endpoint Security for anti-malware, and deploying dynamically updated firewalls to protect against unknown actors. The Information Security Officer performs monthly phishing exercises with the reporting of results to the Information Security Committee and an annual summary of results to the Audit Committee. ACNB Bank also utilizes third-party service providers in the ordinary course of business. As part of ACNB Bank's management program, initial and ongoing information security due diligence is reviewed and assessed on ACNB Bank's service providers as appropriate, based on level of access to, storage of and processing of corporate and customer confidential information. Such due diligence may include review of service organization control reports and other independent testing, information security and incident response programs.


text: As a regulated financial institution, ACNB Bank is also subject to financial privacy laws and its cybersecurity practices are subject to oversight by the federal banking agencies. For additional information, see "Supervision and Regulation" included in Part I. Item 1 – Business of this report.


text: Although ACNB has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that ACNB will not experience such an incident in the future or the potential impact thereof. For additional information regarding the risk ACNB faces from cybersecurity threats, please see the risk factors titled "ACNB's operations of its business, including its transactions with customers, are increasingly done via electronically, and this has increased its risks related to cybersecurity." and "ACNB's communications, information, and technology systems may experience a failure, interruption or breach in security." included in Part I. Item 1A. – Risk Factors of this report.


text: ACNB engages independent third-party assessors and auditors in connection with its information security program, including to conduct external and internal penetration testing and internal vulnerability scanning, independent audits and risk assessments. Technology Services personnel perform internal security practices, including periodic internal vulnerability scanning using commercial software tools and follow-up with corrective measures as required, monitoring for unauthorized access attempts, uses dynamically updated Endpoint Detection and Response for anti-malware, and deploying dynamically updated firewalls to protect against unknown actors. Platforms are in place with the ability to automate containment without the risk of employee response delays and a third party provider performs additional external vulnerability scanning, network threat detection and automated containment, risk analysis and continuous monitoring. The Information Security Officer performs monthly phishing exercises with the reporting of results to the Information Security Committee and an annual summary of results to the Audit Committee. ACNB Bank also utilizes third-party service providers in the ordinary course of business. As part of ACNB Bank's management program, initial and ongoing information security due diligence is reviewed and assessed on ACNB Bank's service providers as appropriate, based on level of access to, storage of and processing of corporate and customer confidential information. Such due diligence may include review of service organization control reports and other independent testing, information security and incident response programs.


text: Although ACNB has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition, there can be no guarantee that ACNB will not experience such an incident in the future or the potential impact thereof. For additional information regarding the risk ACNB faces from cybersecurity threats, please see the risk factors titled "ACNB's operations of its business, including its transactions with customers, are increasingly done electronically, and this has increased its risks related to cybersecurity". and "ACNB's communications, information, and technology systems may experience a failure, interruption or breach in security". included in Part I. Item 1A. — Risk Factors of this report.


text: The Corporation maintains comprehensive and continually evolving processes for assessing, identifying, and managing material risks from cybersecurity threats, including any potential unauthorized occurrence on, or conducted through, the Corporation's information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or any information residing on such systems. The processes relating to cybersecurity threats are integrated into the Corporation's overall risk management processes, which are overseen by the entire board of directors and not delegated to any committee or subcommittee of the board.

companyName: PENNS WOODS BANCORP INC


text: As part of the Corporation's overall risk management processes, the board of directors has established both a senior management Risk Management Committee and a separate senior management Information Technology Steering Committee. Each of these Committees meets regularly and consists of the Corporation's senior management department heads, plus the Chief Executive Officer and the President and Chief Financial Officer of the Corporation (each of whom also serves as a director of the Corporation). The Information Technology Steering Committee reports directly to the board of directors, with the Corporation's Chief Information Officer ("CIO") presenting to the board a detailed report on information systems and cybersecurity matters at least once annually. The board of directors also receives and reviews copies of minutes of all meetings of both the Risk Management Committee and the Information Technology Steering Committee.


text: The Corporation's information technology resources are managed by a separate Information Technology Department, which is responsible for identifying, assessing, and managing material risks from cybersecurity threats. The Information Technology Department is managed by the CIO, who reports to the Corporation's President and Chief Financial Officer. The present CIO has been employed by the Corporation in the information technology area for twenty-nine years and holds an undergraduate degree in computer science. The Information Technology Department also employs a separate Information Security Officer ("ISO"), whose responsibilities include security relating to the Corporation's information systems. The present ISO is a Certified Information Systems Security Professional and also a Certified Fraud Examiner. The ISO reports directly to the Information Technology Steering Committee and to the Chief Risk Officer. The ISO, among other duties, supervises internal employee training relating to cybersecurity risks, conducts access reviews relating to the Corporation's information systems, and monitors implemented checks and balances relating to access to information. Information relating to cybersecurity risks and cybersecurity incidents, if any, is reported by the CIO and the ISO to both the Risk Management Committee and to the Information Technology Steering Committee, each of which Committees includes the Chief Executive Officer and the President and Chief Financial Officer who are also directors of the Corporation.


text: The Corporation maintains an Incident Response Plan that provides documented guidelines for handling potential threats and taking appropriate measures including timely notification of cybersecurity threats and incidents to senior management and the board of directors when appropriate. The Incident Response Plan is managed by the Information Technology Department, including the ISO, and is reviewed and tested at least annually.


text: The Corporation uses third-party vendors to assist in monitoring, detecting, and managing cyber threats, including managed security service monitoring, penetration testing and vulnerability assessment. The Risk Management Committee has established risk management guidelines for third-party vendors. The Corporation conducts due diligence reviews of third-party vendors before contracts or agreements for provision of services are signed and conducts ongoing due diligence and oversight procedures with the frequency of the procedures determined based on a risk assessment of the services provided. Generally, the Corporation's agreements with service providers include requirements related to cybersecurity and data privacy. All such agreements are reviewed at least annually. The Corporation cannot guarantee, however, that such agreements, due diligence, and oversight procedures will prevent a cybersecurity incident from impacting information systems. Moreover, as a result of applicable laws and regulations or applicable contractual provisions, the Corporation may be held responsible for cybersecurity incidents attributed to its service providers in relation to any data that the Corporation shares with such providers.


text: To date, the Corporation has not experienced any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Corporation, including its business strategy, results of operations, or financial condition. As discussed under "Risk Factors" in Item 1A, however, the sophistication of cybersecurity threats continues to increase, and the preventative actions taken by the Corporation to reduce the risk of cybersecurity threats or incidents may not be sufficient in a particular circumstance. Accordingly, the Corporation may not be able to anticipate all cybersecurity breaches no matter how well designed or implemented the Corporation's cybersecurity controls and procedures are, and the Corporation may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: We have implemented a cybersecurity program to address all levels of cybersecurity threats based on our determination of the risk level. Our program includes policies and procedures that dictate the method in which we develop, deploy, and maintain security measures and controls. We use a cybersecurity framework to select security controls to protect against identified risks. When designing the controls, we consider the severity of risk and its impact on the Company, including the cost of the control and the impact it may have on the Company operations. We use various combinations of controls and tools to mitigate the risk to the Company such as firewalls and intrusion devices, endpoint threat detection systems, multi-factor authentication systems, endpoint threat detection systems as well patch management to prevent exploitable vulnerabilities.

companyName: READING INTERNATIONAL INC

ticker: RDI


text: We utilize third-party cybersecurity firms in various capacities to operate some of these controls, including remote monitoring, cloud-based platforms and services as well as on-premises services. For example, we use third parties to perform a variety of functions for the Company, including, but not limited to cybersecurity audits, targeted ransomware assessment and table-top exercises, internal penetration tests and other internal and external audits. These expert services enable us to leverage specialized knowledge and insights into our cybersecurity strategies and processes.


text: We maintain a written incident response plan and carry out periodic tabletop exercises to improve incident response readiness. Employees undergo security awareness training when hired and periodically thereafter; the scope of this training is continually updated to address newly identified threats. We utilize a risk-based approach and analysis to determine the cybersecurity controls to implement, and hence, there is a possibility that these controls may not adequately address every risk if we do not identify or place a high enough risk factor on a given threat. We are at risk of zero-day attacks and other vulnerabilities that may have been placed at a very low risk. In addition, even well-designed and properly deployed controls may not fully eliminate a given risk.


text: We have not had any cybersecurity incidents that we believe have materially affected or are likely to materially affect the Company. GOVERNANCE.


text: Board Member Guy W. Adams serves as our Lead Technology and Cyber Risk Director. In December 2017, Mr. Adams was recognized as a Governance Fellow for the National Association of Corporate Directors, The Gold Standard Director Credential. In 2018, Director Adams completed the Cyber-Risk Oversight course presented by the National Association of Corporate Directors.


text: We utilize third -party cybersecurity firms in various capacities to operate some of these controls, including remote monitoring, cloud-based platforms and services as well as on-premises services. For example, we use third parties to perform a variety of functions for the Company, including, but not limited to cybersecurity audits, targeted ransomware assessment and table-top exercises, internal penetration tests and other internal and external audits. These expert services enable us to leverage specialized knowledge and insights into our cybersecurity strategies and processes.


text: We have defined policies and procedures for cybersecurity incident detection, containment, response, and remediation and have adopted physical, technological, and administrative cybersecurity and data privacy controls. The Company established a cybersecurity incident response plan, which includes classification of cybersecurity incidents, to whom to escalate an incident, and when to escalate a cybersecurity incident, including direct communication to the Chief Digital Officer ("CDO") and VP of IT, Director, and President. The Company regularly conducts risk assessments and tracks remediation to completion. Critical systems are periodically audited against industry standards.

companyName: REGIS CORP

ticker: RGS


text: Key elements of our cybersecurity risk management program include, but are not limited to, the following: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • A security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • Cybersecurity awareness training of our employees; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • A third-party risk management process for service providers based on our assessment of their criticality to our operations and respective risk profile.


text: Our CDO directs, coordinates, plans, and organizes information security activities throughout the Company, including leading the development of our cybersecurity risk management strategy.


text: We have not historically been materially impacted by risks from cybersecurity threats and as of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business.


text: We have defined policies and procedures for cybersecurity incident detection, containment, response, and remediation and have adopted physical, technological, and administrative cybersecurity and data privacy controls. The Company established a cybersecurity incident response plan, which includes classification of cybersecurity incidents, to whom to escalate an incident, and when to escalate a cybersecurity incident, including direct communication to the Director of Information Security, Vice President of IT, our President and our Board of Directors. The Audit Committee receives periodic reports on the Company's cybersecurity measures, protections, response plans, etc. The Company regularly conducts risk assessments and tracks remediation to completion. Critical systems are periodically audited against industry standards.


text: Our Director of Information Security directs, coordinates, plans, and organizes information security activities throughout the Company, including leading the development of our cybersecurity risk management strategy. Our Director of Information Security has more than 35 years of relevant IT experience, including 20 years directly managing information security, holds professional certifications including ISC(2)'s Certified Information Systems Security Professional (CISSP—issued 2006) and ISACA's Certified Information Security Manager (CISM—issued 2006), and has ongoing involvement in various professional organizations, including serving for the last 15 years on the governing body of the Gartner/Evanta Minneapolis CISO summit, and is a member of the Minnesota chapter of ISACA.


text: Murphy's cybersecurity environment is led by the Company's Information Technology (IT) group, which, in addition to cybersecurity matters, oversees the Company's IT infrastructure. Within the IT group, the Murphy Cybersecurity Team (MCT) is responsible for monitoring and managing security of the corporate network and enterprise systems, including developing and deploying policies, technical controls, and safety protocols and responding to security threats. All members of the MCT hold globally recognized security certifications and have wide-ranging experience in cybersecurity matters. The Incident Management Team (IMT) is responsible for responding to active threats and incidents as they occur. The Chief Information Officer is a member of the IMT, and regularly provides briefings to the Chief Executive Officer, the executive leadership team, and the Audit Committee of the Board. The Audit Committee is ultimately responsible for ensuring that management has processes in place to identify and evaluate cybersecurity risks to which Murphy is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board. We believe this visibility and oversight structure allows the Board and executive leadership team to make timely, data-driven decisions ensuring that Murphy, its employees, investors, and partners are adequately protected.

companyName: MURPHY OIL CORP

ticker: MUR


text: Murphy considers its protection from cybersecurity threats to be a core component of its overall enterprise risk management system. Murphy's cybersecurity risk management framework consists of cyber readiness, cybersecurity governance, and risk management strategy. The cybersecurity risk management framework is incorporated into the overall enterprise risk management process through policies, procedures, periodic simulations, and constant monitoring of the cybersecurity environment for new and emerging threats. The Company also requires employees to receive regular cybersecurity training and education to mitigate cybersecurity risks. To remain informed of the cybersecurity landscape, the Company collaborates with peers, third party advisors, industry groups and policymakers.


text: Murphy engages cybersecurity assessors, consultants, our internal auditors, and other third parties both periodically and as appropriate when cyber threats are identified. Murphy utilizes these consultants to perform forensic analysis of data published by threat actors, to monitor and scan Murphy's systems for threat vectors, and to consult on emerging cybersecurity environment topics.


text: Murphy utilizes industry leading technologies that focus on continuous monitoring and analytics built on machine learning and artificial intelligence to safeguard against sophisticated cyberattacks. Deployed technologies include next generation firewalls, advanced endpoint and email protection, multi-factor authentication and Managed Detection and Response. In addition to the monitoring and detection processes for its own IT systems, Murphy also has processes in place to identify cybersecurity threats associated with third party service providers and partners; these processes include industry information sharing groups, cybersecurity notification services, vendor risk assessments, and ongoing collaboration with federal agencies.


text: Murphy has not experienced any material impacts to our business, operations, or reputation due to cyberattacks or other security-related incidents. However, we recognize cyber threats are constantly evolving and are committed to cultivating a culture of security, remaining vigilant and continually improving our cybersecurity environment and controls.


text: Murphy's cybersecurity environment and risk strategy is broadly managed by the Company's Information Technology (IT) group, which oversees the Company's IT and Operational Technology (OT) infrastructure. Within the IT group, the Murphy Cybersecurity Team (MCT) is specifically responsible for monitoring and managing security of the enterprise IT and OT network and systems, including developing and deploying administrative policies, technical controls, and safety protocols necessary to prevent unauthorized access, theft, damage, or loss of Company data or systems. All members of the MCT hold globally-recognized security certifications and have wide-ranging experience in cybersecurity matters. The Incident Management Team (IMT) is responsible for responding to active security threats and incidents as they occur. The Chief Information Officer oversees the IT group and is a member of the IMT, and provides briefings to the CEO, the executive leadership team, and the Audit Committee of the Board regarding cybersecurity risks, strategy, and management at least annually. The Audit Committee is ultimately responsible for overseeing cybersecurity strategy and ensuring that management has sufficient resources, programs, and processes in place to identify, evaluate, manage, and mitigate relevant cybersecurity risks to which Murphy is exposed and to implement processes and programs to manage cybersecurity risks and mitigate any incidents. The Audit Committee also reports material cybersecurity risks to the Board as appropriate. We believe this visibility and oversight structure allows the Board and executive leadership team to make timely, data-driven decisions ensuring that Murphy, its employees, investors, and partners are adequately protected.


text: Murphy considers its cybersecurity risk management framework to be a core component of its overall enterprise risk management system. The cybersecurity risk management framework directly aligns with the National Institute of Standards and Technology Cybersecurity Framework and involves regular review and update of security policies and procedures; leverage of industry-leading technologies focused on continuously monitoring, analyzing, and defending against intrusions; regular testing of such technologies and other controls; periodic simulations of security incidents; and constant monitoring of the broader cybersecurity environment for new and emerging threats. The Company also requires employees to attend regular cybersecurity training and education to mitigate cybersecurity risks. To remain informed of the cybersecurity landscape, the Company collaborates with peers, third-party advisors, industry groups and policymakers.