Company: MTB-PJ
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001628280-25-006267
Chunk: 84

Company: M&T BANK CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 84
---
 Risk Committee of the Board and the Board of Directors receive the results of the Company’s annual cybersecurity risk assessment. Aligned with leading industry standards, including the U.S. Department of Commerce’s National Institute of Standards and Technology Cybersecurity Framework, the Information Security Program is built upon a foundation of policies, standards and procedures, which leverage the National Institute of Standards and Technology standards and regulatory requirements, to help safeguard customer information and reduce the risk of cyber incidents and breaches. The Information Security Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring and a Security Operations Center that provides full-time support and additional operational measures to monitor and respond to data breaches and cyber attacks.In accordance with the Gramm-Leach-Bliley Act, the Company undertakes periodic assessments to identify and assess risks to customer information and evaluate the effectiveness of security controls. The Company engages third parties in connection with such cybersecurity preparedness efforts. Ongoing audits, including vulnerability and penetration testing of the Company’s computing infrastructure, are performed by independent third parties and by our internal cybersecurity personnel.  The Company has also established processes to oversee and identify cybersecurity risks from third-party service providers. Third-party service providers (including suppliers and business partners) are required to have security policies, standards and procedures that meet or exceed the information security guidelines as specified in the Information Security Program. The Company has an established third-party due diligence program designed to ensure vendors meet the Company's expectations as agreed to in their contract. Roles, responsibilities and expectations for service providers and other third parties are communicated and documented through contracts (and other associated agreements) and monitored through oversight as part of the Company’s Third-Party Risk Management Program. The Company’s Cybersecurity Leadership Team includes the CISO who is responsible for overseeing and reporting on the development and implementation of the Company's Information Security Program. The CISO has over twenty years of experience in information security for large financial institutions and has served as chairman for the Bank Policy Institute's Technology Policy Division Information Security Committee and as a board member of Financial Services Information Sharing and Analysis Center. The CISO currently serves on the Advisory Council for New York University's Graduate School of Engineering, as well as the Advisory Board for University of North Carolina - Charlotte College of Computing and Informatics. The CISO reports to the Company’s Chief Information Officer, Mr. Michael A. Wisler, who is an Executive Officer of M&T and has two decades of experience in the financial and technology industries. Prior to joining the Company in 

46

2018, Mr