Company: ONBPP
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0000707179-25-000005
Chunk: 73

Company: OLD NATIONAL BANCORP /IN/
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 73
---
ITEM 1C.    CYBERSECURITY

CYBERSECURITY RISK MANAGEMENT AND STRATEGY

Old National’s enterprise risk management program is designed to identify, assess, and mitigate various financial, operational, regulatory, legal, and reputational risks. Cybersecurity is a critical component of that program, especially in light of the significant, persistent, and ever-evolving cybersecurity risks facing us and other financial institutions. For further discussion of such risks, see the section entitled “Risk Factors” in Item 1A of this Form 10-K under the heading “Operational Risks.” Our objective is to maintain a robust cybersecurity program designed to protect the confidentiality, integrity and availability of our information systems and critical operational processes, including through identification of material information assets and systems, deployment of controls designed to protect against known cybersecurity threats, prompt detection of any cybersecurity threats that make it past our 

31

defenses, maintenance of documented, tested approaches for responding to cybersecurity threats and establishment of recovery techniques and technologies to promote resilience from any cybersecurity incidents.As a result, the Company has developed and maintains an Information Security Program (“ISP”) and various related policies, standards, guidelines, and procedures, as a core part of its enterprise risk management program. The ISP establishes control requirements for addressing cybersecurity risks, defines stakeholder roles and responsibilities, and sets the foundation for the program’s importance within the Company. We structure our ISP around the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework, regulatory guidance, and other industry standards. In alignment with recommendations from NIST and other relevant industry guidelines, the Company maintains a layered cybersecurity strategy based on prevention, detection, and response/mitigation. Internal and third-party contracted technical and procedural controls include, among others, the following types: preventative (including firewalls, end-point detection and response, data loss prevention, access controls, internal/external penetration testing); detective (such as security monitoring and event management); and responsive (including through business continuity plans and an enterprise-wide Cybersecurity Incident Response Program, which provides a documented framework for handling high-severity security incidents and facilitates coordination across multiple parts of the Company to manage response efforts. The Company administers phishing tests routinely and publishes articles and alerts on its intranet regarding common attack schemes for the employees’ awareness. Information security training is also conducted annually as continuing education for all employees.We continually review and seek enhancements to our cybersecurity programs and processes. The ISP is periodically reviewed by internal Company stakeholders and modified to respond to changing cybersecurity threats and conditions. We regularly test