Company: KEY-PI
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000091576-25-000038
Chunk: 200

Company: KEYCORP /NEW/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 200
---
 our environment to proactively identify weakness within our security policy and/or configurations. Summary level results from these assessments are shared to internal stakeholders through Key’s Risk Governance committee structure. Key is also subject to cybersecurity and privacy regulatory exams, as required by law for financial institutions.Key has implemented cybersecurity, privacy, and fraud education and awareness programs across theenterprise to educate teammates on how to identify and report cybersecurity and privacy concerns. Employees andcontractors with access to assets or data owned or maintained by Key receive mandatory enterprise-widecybersecurity, privacy, and fraud training on an annual basis. In addition, our management team from time to time participates in cybersecurity tabletop exercises that simulate cybersecurity incidents. These exercises are intended to test our response to potential incidents and assess the procedures outlined in our incident response playbooks. With respect to third party service providers, Key maintains a third party management program that is designed toidentify, review, monitor, escalate, and, if necessary, remediate third party information security risks. Key’s thirdparty onboarding process includes risk-based due diligence and security-relevant contract language. Risk-baseddue diligence can also include an assessment of the strength of certain control areas, including, but not limited to,information security management, physical security, network security, platform security, application security, cloudsecurity, encryption management, business resiliency, and privacy. Once a business relationship is established with a service provider, Key performs risk-based periodic reviews of the third party service provider's security programs. In addition to an established governance approval process for new engagements, Key has established a Third Party Management Committee to oversee compliance with Key’s Third Party Management Policy and Program.

Cybersecurity Governance

As described in more detail in “Risk Management — Overview” in Item 7 of this report, the Board serves in anoversight capacity to ensure that Key’s risks, including risk from cybersecurity threats, are managed in a manner that is effective and balanced and adds value for our shareholders. The Board’s Risk Committee exercises primary oversight over enterprise-wide risk at Key, including operational risk, which includes cybersecurity risk, and provides oversight of management’s activities related to cybersecurity risk. The Board’s Audit Committee monitors and exercises oversight over cybersecurity risk as part of its joint oversight of operational risk with the Risk Committee. The Board’s Technology Committee provides additional oversight of management’s activities related to Key’s technology strategic investment plan, cybersecurity investments, and major technology vendor relationships and is expected to escalate to the Risk Committee on certain risk management issues.

Key’s CISO oversees the IS Program and its related policies