Company: BANC-PF
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001628280-25-009438
Chunk: 291

Company: BANC OF CALIFORNIA, INC.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1B
Chunk 291
---
ITEM 1B. UNRESOLVED STAFF COMMENTS

None.

ITEM 1C. CYBERSECURITY

Cybersecurity Risk Management and Strategy

Our enterprise risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of our company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Chief Information Security Officer (“CISO”) is primarily responsible for our cybersecurity program and is a key member of the risk management function, reporting directly to the Chief Risk Officer (“CRO”) and to the Enterprise Risk Committee of our Board of Directors.

Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our information security program is designed in accordance with industry frameworks, such as the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework, and is periodically reviewed and updated at least annually and upon significant changes to our operating environment. Our program includes the following key elements:

•Systems Safeguards. We adopt the “trust by design” framework when designing new products, services and technology. We employ a variety of administrative, preventative and detective controls and tools designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. 

•Incident Response. We maintain an Incident Response Plan (“IRP”) that provides a documented framework for responding to actual or potential cybersecurity incidents. The IRP is coordinated through the CISO and key members of management and addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements.

•Collaboration. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems and controls, including with respect to our information security program, to assess their design and operating effectiveness.

•Education and Training. We have regular and ongoing security education and training for employees, practical exercises that simulate actual cyber-attacks, and recovery and resilience tests. 

•Third-Party Risk Management. We maintain a third-party risk management program designed to identify, assess and manage cybersecurity risks associated with external service providers, contractors and vendors.

To our knowledge, cybersecurity threats, including as