Company: UVSP
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000102212-25-000006
Chunk: 140

Company: UNIVEST FINANCIAL Corp
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1B
Chunk 140
---
 with service providers to ensure security maintenance and reporting responsibilities are operating according to contract provisions and that service providers provide notification of system security breaches that may affect the Corporation.

Internal Controls, Audit, and Testing. Regular internal monitoring is integral to the Corporation's risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party 

23

Table of Contents

penetration testing to test the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.

Service Providers. Like many companies, the Corporation relies on third-party vendor solutions to support its operations. Many of these vendors, especially in the financial services industry, have access to sensitive and proprietary information. In order to mitigate the operational, informational and other risks associated with the use of vendors, the Corporation maintains a Third-Party Risk Management Program, which is implemented through a Third-Party Risk Management Policy and includes a detailed onboarding process and periodic reviews of vendors with access to sensitive Corporation data. The Third-Party Risk Management Policy applies to any business arrangement between the Corporation and another individual or entity, by contract or otherwise, in compliance with the Interagency Guidance on Third-Party Relationships: Risk Management. The Third-Party Risk Management Program is reviewed as part of the Corporation's annual Internal Audit Risk Assessment.

Employees and Training. Employees are an important defense against cybersecurity threats. Each employee is responsible for protecting Corporation and client information. Employees are provided training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization. In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities. In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from incidents. Notable technologies include firewalls, intrusion detection systems, security automation and response capabilities, user behavior analytics, multi-factor authentication, data backups to immutable storage and business continuity applications. Notable services include 24/7 security monitoring and response, continuous vulnerability scanning, third-party monitoring, and threat intelligence. 

Board Reporting. On a quarterly basis, the CISO reports to the Board, directly or through the Enterprise-Wide Risk Management Committee, on the overall status of the Information Security Program, including the Corporation's compliance with the Interagency Guidelines for Safeguarding Customer Information. Any material findings related to the risk assessment, risk management