Company: RNST
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000715072-25-000054
Chunk: 73

Company: RENASANT CORP
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 73
---
 implementing patches, and if implementation timing falls below performance expectations, management will take steps to identify and remediate the root causes of implementation delays.•Risk assessments: At least annually, management conducts risk assessments to assess the existence, severity and trends of cybersecurity risks and other risks that the Company’s information security program faces. The scope of an individual risk assessment can be the whole organization, parts of the organization, an individual information system, specific system components, or services.•Log management: System security logs are consolidated by the Company’s Security Incident and Event Management system and are reviewed via both automatic and manual processes for anomalous behavior. •Incident response: The incident response process is designed to, among other things, promptly elevate a cybersecurity threat or incident to the parties responsible for leading our efforts to identify, contain and mitigate the threat or incident, notify impacted customers or other third parties and comply with applicable law, regulations and regulatory expectations.•Employee training: Information security is an integral component of our employee training program. Training includes efforts to maintain security awareness among employees at all times by means of company-wide communications of cybersecurity risks or incidents affecting third parties, internal testing and similar efforts.

28

The information security program applies to all of the Company’s business lines and employees as well as to vendors and other third parties with access to the Company’s information systems or its confidential and proprietary information. Whenever we consider a new product or service to offer to our clients, or a new means of offering or providing an existing product or service, or a new back-office process or procedure, the implications to the Company’s information security are required to be considered.Our CISO, a Certified Information Systems Security Professional, leads the Company’s information security team, which has over 50 years’ combined experience in providing solutions to manage information security, compliance, privacy and technology management. The Board of Directors’ Technology Committee and its Enterprise Risk Management Committee (the “ERM Committee”) oversee our information security team, receiving regular updates related to the material features of the information security program, our success and failures in maintaining information security and emerging threats and management’s proposed response thereto.Strategy and Testing.  As mentioned above, the Company employs a layered, defense-in-depth approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block and provide alerts regarding suspicious activity and to report on any suspected threats. These controls include appropriate access controls based on least privilege, multifactor authentication for remote and privilege access, and encryption to protect data