Company: RNST
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000715072-25-000054
Chunk: 78

Company: RENASANT CORP
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 78
---
, our risk metrics cannot remain static. At least annually, the Risk Department meets with the CISO to assess whether the risk metrics, and the tolerances for each metric, remain appropriate in light of the Company’s operations and the cybersecurity threat environment.As the third line of defense against cybersecurity risk, our Internal Audit Department, with the assistance of outside experts, annually reviews and tests the Company’s processes, including its policies, procedures and controls, with respect to cybersecurity risk. The Internal Audit Department reports the results of its review, including the steps management intends to take to address any findings, to the Audit Committee of the Board of Directors.Finally, as a means to ensure that our senior executive management has an integrated understanding of the cybersecurity and other risks facing the company at any particular time, the Company has organized a Management Enterprise Risk Management Committee (the “management ERM committee”). Our Chief Risk Officer leads this committee, whose membership includes the Company’s President and the leaders of our major business lines and back-office functions. Among other things, the management ERM committee reviews the Company’s cybersecurity and other risk metrics and the direction in which each risk is trending (increasing risk or decreasing risk), both in isolation and in the context of other existing and emerging risks facing the company, and the status of risk mitigants therefor. We believe that this committee helps management better focus its efforts to minimize cybersecurity risk and that it assists in more focused reporting of cybersecurity risks to the Board of Directors.

Board Oversight.  The Company’s Board of Directors primarily oversees the risks related to our technological infrastructure, information security, cybersecurity, business continuity and disaster recovery programs through its Technology Committee and the ERM Committee. These committees meet quarterly, and their activities are reported to the full Board of Directors.The Technology Committee is responsible for the oversight of Renasant’s strategies and operations with respect to information technology. Although this committee’s focus is broader than just information security and cybersecurity risk, at each meeting the CISO reports to the committee on, among other topics, the status of any cybersecurity and network security initiatives designed to enhance the Company’s cybersecurity, emerging cybersecurity risks that may not yet be addressed by the existing risk metrics and management’s plans to mitigate such risks, and employee training on cybersecurity and related issues. The ERM Committee incorporates the assessment, monitoring and mitigation of cybersecurity risk into its monitoring of the Company’s broader enterprise risk management function. The Company tracks numerous risk metrics relating to cybersecurity, and at each meeting of the ERM Committee, the Chief Risk Officer reports on the status within established