Company: NWBI
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001471265-25-000016
Chunk: 69

Company: Northwest Bancshares, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1B
Chunk 69
---
 facilitate coordination across multiple parts of our organization and are evaluated at least annually.Integral elements of the Plans related to the Company’s response to cybersecurity vulnerabilities include the following:•Identifying the appropriate team and any appropriate sub-teams to address specific system failures, interruptions, or cybersecurity breaches, or categories thereof.•Coordinating incident or crisis management activities, including developing, maintaining, and following appropriate procedures to respond to and document identified system failures, interruptions, or cybersecurity breaches.•Conducting post-incident reviews to gather feedback on incident response procedures and address any identified gaps in cybersecurity measures.•Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the Plans.•Reviewing the Plans at least annually, or whenever there is a material change in the Company’s business practices that may reasonably affect its incident response procedures.Not withstanding our defensive measures and processes, the threats posed by system failures, interruptions, or cybersecurity breaches are severe. For further discussion of risks from cybersecurity threats, see the section captioned “Risks Related to Operational Matters” in Item 1A. Risk Factors.

Governance. Our CISO is accountable for managing our enterprise cybersecurity department and delivering our cybersecurity program. The responsibilities of this department include privacy, resiliency, cybersecurity risk assessment, defense operations,  incident response, vulnerability assessment, threat intelligence, identity access governance, and the evaluation of third-party risk management and business resilience as it relates to the cybersecurity program. 

The foregoing responsibilities are covered on a day-to-day basis by our CISO and their team. The cybersecurity department consists of cybersecurity professionals with varying degrees of education and experience. Individuals within the cybersecurity department are generally subject to professional education and certification requirements. Our CISO has substantial relevant expertise and formal training in the areas of cybersecurity risk management, including 25 years of cybersecurity experience in the financial services, retail, insurance sectors.

Our Board of Directors has established management committees including the Innovation and Technology Steering Committee (ITSC), which focuses on overseeing our information security and technology programs, including management’s actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks, and the Operational Risk Management Committee, which focuses on the identification, monitoring, assessment, and management of risk associated with our cybersecurity program. These committees provide oversight and governance of the cybersecurity program and are chaired by the CIO and Chief Operational Risk Management Officer, respectively, and include the CISO and other key departmental managers from throughout the Company. The ITSC meets quarterly  and the Operational Risk Management Committee