Company: NWBI
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001471265-25-000016
Chunk: 67

Company: Northwest Bancshares, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1B
Chunk 67
---
Table of Contents

ITEM 1B.    UNRESOLVED STAFF COMMENTS

Not applicable.

ITEM 1C.    CYBERSECURITY

Risk Management and Strategy

Our risk management program is designed to identify, assess, and mitigate risks across various aspects of the Company, including credit, market, treasury, operational, compliance, model and data, and reputational risks. Cybersecurity is a critical component of this program, given the increasing reliance on technology and potential for system failure, interruption, or a cybersecurity breach to occur, which could disrupt business operations or compromise confidential, personal, sensitive or proprietary information. Our CISO is primarily responsible for this cybersecurity component and is a key member of the organization, reporting directly to the CIO (who then reports directly to our Chief Executive Officer) and, as discussed below, periodically to the Innovation and Technology Committee, Enterprise Risk Committee and to our Board of Directors. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.In an effort to prepare for and respond to system failures, interruptions or cybersecurity breaches, the Company has implemented a multi-layered cybersecurity program that integrates people, technology, and processes and is intended to comply with the information security standards established pursuant to the Gramm-Leach-Bliley Act (GLBA) 12 CFR 364, Appendix B. This cybersecurity program includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of information security, data governance, business continuity and disaster recovery, privacy, third-party risk management, and incident response. Our objective for managing cybersecurity risk is to avoid or minimize the impacts of external threat events or other efforts that penetrate, disrupt or misuse our systems or information. The cybersecurity program is built upon a foundation of advanced security technology, our internal employee team, and operations based on industry best practice and recommendations from the National Institute of Standards and Technology (NIST) Cybersecurity Maturity Framework, Federal Financial Institutions Examination Council (FFIEC) Guidelines, and Center for Internet Security (CIS) Benchmarks. This consists of controls designed to govern, identify, protect, detect, respond and recover from system failures, interruptions, and cybersecurity breaches. Our CISO and our CIO, along with key members of their teams, regularly collaborate with peer banks, industry groups, and policymakers to discuss cybersecurity trends and issues and identify best practices. The cybersecurity program is periodically reviewed by such personnel with the goal of addressing changing threats and conditions