Company: UMBFO
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028420
Chunk: 67

Company: UMB FINANCIAL CORP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1B
Chunk 67
---
 on information security, technology and privacy matters.  The STP serves as a sub-committee of the Company’s Enterprise Risk Committee (ERC), which is a sub-committee of the Board Risk Committee.  The ERC is chaired by the CRO, and includes members of executive management and a cross-functional team of leaders experienced in managing risk.  The STP and ERC receive quarterly briefings from the CISO/CPO on a variety of topics, including material changes in information security or privacy laws, the Company’s ongoing information security posture and compliance, and emerging risks. Company management and its committees may also engage with the CISO/CPO to discuss and receive additional reports regarding cybersecurity and privacy risks on a more frequent basis as appropriate.Key Program ComponentsThe Company has a vulnerability management program designed to assess and manage risk associated with vulnerabilities in its information systems from multiple perspectives, including: (i) an adversarial cyber risk assessment that aims to identify threats, vulnerabilities and controls and (ii) the scanning of external and internal information systems to identify software vulnerabilities.  The vulnerability management program also assesses emerging and potential threats through dedicated threat intelligence capabilities that monitor attacks and breaches associated with financial institutions and key third-party service providers. The CISO/CPO utilizes the data to understand potential exposure to the Company and to take preventative action where appropriate.  The Company has an Incident Response Program (IRP) to support management of cybersecurity or privacy incidents, impact assessment (i.e., type and quantity of data impacted, materiality, etc.), and response coordination including with law enforcement and government agencies, and impacted parties. Notification procedures are aligned with applicable laws, regulatory and contractual requirements, including rules promulgated by the SEC, the GLBA, the GDPR and state privacy regulations. The Company’s IRP, led by the CISO/CPO, includes a cross-functional group of risk, technology, privacy and legal experts supplemented by third-party service providers, where necessary, to support the Company’s response to potential cybersecurity or privacy incidents. The IRP sets forth the framework to elevate cybersecurity or privacy issues to the CISO/CPO and when and how incidents are escalated and reported beyond the CISO/CPO, including to executive management and the Board Risk Committee.  Depending on the incident, escalation to the full board of directors may also occur.

32

 The Company has also implemented a third-party risk program to oversee and manage information security and privacy risks associated with third-party relationships. The program includes the assessment of third parties that provide key services or will access, store,