Company: UMBFO
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028420
Chunk: 66

Company: UMB FINANCIAL CORP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1B
Chunk 66
---
 entirely of independent directors, assists the board of directors with this responsibility by, among other things, approving and periodically reviewing the risk management policies of the Company’s global operations, including statements of risk appetite, and adapting the Enterprise Risk Management Policy, when and as appropriate, to changes in the Company’s structure, risk profile, complexity, activities, or size.  The combined Chief Information Security Officer and Chief Privacy Officer (CISO/CPO) supplies the Board, directly or through the Board Risk Committee, with regular reports, on at least a quarterly basis, on the operation of the information security and privacy components of this program, the related evolving risks to the Company’s businesses, and the controls and other mitigants utilized to manage those risks.  Membership in the Board Risk Committee includes directors experienced at managing risk in various environments, including cybersecurity.  Their expertise helps inform the Company’s cybersecurity and privacy program.Management is responsible for the daily assessment and management of cybersecurity risks. This is accomplished through a variety of tools and mechanisms. The Company has strategically integrated cybersecurity and privacy risk management into its broader risk management framework. This integration ensures that cybersecurity and privacy considerations are an integral part of the Company's decision-making processes at multiple levels. The Company has appointed a qualified CISO/CPO, who reports to the Chief Risk Officer (CRO) as part of independent risk management, who is responsible for establishing strategy and overseeing implementation of an integrated and proactive information security and privacy program. The CISO/CPO is also responsible for advising and partnering with the board of directors, management team, and lines of business to guide the management of cybersecurity, business continuity and resilience, physical information security, data privacy, third party and information governance risks. The CISO/CPO has more than two decades of global experience within the information security and privacy fields, a relevant bachelor’s degree from an accredited institution, and holds the National Association of Corporate Directors Directorship Certification (NACD.DC), Certified Information Systems Security Professional (CISSP) and Certified Information Privacy Professional (CIPP/US) designations. The CISO/CPO manages a team of qualified professionals with relevant cybersecurity and privacy experience and expertise. The Company has also established a Security, Technology, and Privacy Committee (STP) to oversee security, technology, and privacy capabilities and risks of the Company and its business.  The STP includes the CRO, CISO/CPO, leadership across the lines of business, and a cross-functional team of risk, technology, privacy and legal experts to ensure an appropriate focus