Company: WBS-PG
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000801337-25-000004
Chunk: 226

Company: WEBSTER FINANCIAL CORP
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 226
---
 by its employees (including contractors and other third parties for training purposes), designed to mitigate accidental information security incidents. Phishing simulation activities are regularly conducted to assess employees’ competency at identifying potential threats. Employees are assigned incremental training requirements should they fail to identify simulated phishing emails through the initial training.The Company’s Corporate Information Security team members are also responsible for completing additional mandatory annual training to understand the processes, procedures, and technical requirements for securing information assets across the enterprise. The Company also offers ongoing practice and specialized education for Corporate Information Security team members to stay up to date with emerging trends in cybersecurity threat protection, detection, and response.The Information Security Management Program sets forth enterprise-wide coordinated responses to identified threats, ensuring timely mitigation and remediation, and facilitating awareness and communication. Tabletop exercises are held regularly at the Senior and Executive management levels to validate roles and responsibilities and response protocols respective to cybersecurity threats. The outcomes of these tabletop exercises are reviewed annually at the Board of Directors level.Employees, contractors, and third parties are required to immediately report any suspected cybersecurity threats to the Corporate Information Security team for triaging. Any threat assessed by the Corporate Information Security team that could impact the safety of customers or personnel, cause damage to, or threaten the confidentiality, integrity, or availability of information assets, or bring about significant business interruption, are escalated for further assessment. In the event that the CISO, in consultation with the Company’s Legal and Compliance teams, determines that a material cybersecurity incident has occurred, a dedicated Crisis Incident Response team comprised of individuals from various departments across the organization is assigned to coordinate all planned cybersecurity incident-related response activities. The Company will engage third party specialists to assist in any cybersecurity incident investigation, as needed.Cybersecurity threats that are identified and deemed material are escalated and communicated directly to Senior and Executive Management and the Risk Committee of the Board of Directors. Materiality determinations are made under the Company’s Disclosure Controls and Procedures to ensure timely cybersecurity incident disclosure notification in accordance with securities laws and/or regulations.Material Cybersecurity Threat Risks. Risks from cybersecurity threats have not materially affected the Company, its business strategy, results of operations, or financial condition for the year ended December 31, 2024. However, it is possible that the Company could suffer such losses in the future. Information regarding risks from material cybersecurity threats can be found under the section captioned “Information Risk” contained in Item 1A. Risk Factors.

Governance. Oversight of information security risk and information technology risk is the responsibility of the Information Risk Committee, a management