Company: BOH
Filing Date: 2025-03-04
Form Type: 10-K
Source: 0000950170-25-031193
Chunk: 43

Company: BANK OF HAWAII CORP
Filing Date: 2025-03-04
Form: 10-K
Item: Item 1B
Chunk 43
---
None.

Item 1C.  Cybersecurity As a company that collects and retains large volumes of customer and employee data, including payment card numbers and other personally identifiable information, we face significant and persistent cybersecurity risks. The protection and integrity of that data is important to us, which is demonstrated by the significant efforts and investments made to implement various measures to manage the risk of a security breach or disruption. Risk Management and Strategy Assessing, identifying, and managing cybersecurity related risks are integrated into our overall Enterprise Risk framework, of which one of the objectives is to ensure the confidentiality, integrity, and availability of our information sets through the maintenance of a comprehensive information security program. The program ensures regulatory compliance in alignment with Federal Financial Institutions Examination Council, the Sarbanes-Oxley Act of 2002, and the Gramm-Leach-Bliley Act. One of the key aspects of this program is a risk assessment that is used to identify industry and company-specific risks, measure control 

18

Table of Contents

effectiveness, identify any gaps that need to be addressed, and linking our controls with applicable policies, standards and guidelines to ensure that responsible parties are aware of their obligations with respect to this program. Governance The Board of Directors holds ultimate responsibility for overseeing cybersecurity and information security risks. They dedicate substantial time and attention to this critical area, leveraging the technical expertise of their members. The Board regularly reviews an Enterprise-Wide Risk Report, which includes key cybersecurity risk measures and trends across the Company. Additionally, the Board annually reviews and approves the Information Security Policy and frequently receives presentations from the Chief Information Security Officer (“CISO”) on cybersecurity risks, industry trends, and best practices. The Risk Management Committee, which is charged with assisting the Board of Directors in fulfilling its oversight responsibilities related to the Company’s enterprise-wide risk management framework, receives an operational risk update at least quarterly that includes a review of cybersecurity and information security risk. The Board of Directors is also responsible for the approval and oversight of the Information Security (“IS”) Program. Our CISO, who is designated as the IS Program Coordinator, has over 15 years of relevant information technology, security and program management experience. Under the direction of the CISO, the IS Program focuses on preventing, detecting, and responding to cybersecurity incidents by ensuring the confidentiality, integrity and availability of company information. Central to incident management is the Information Security Incident Response Team, which is responsible for responding expeditiously and effectively to security incidents to minimize risks to the business, customers