Company: STBA
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000719220-25-000013
Chunk: 123

Company: S&T BANCORP INC
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 123
---
 assisting the Board with fulfilling its fiduciary responsibilities with respect to its oversight and assessment of S&T’s enterprise-wide risk management framework. The Risk Committee oversees risk from cybersecurity threats as a part of its oversight of the ERM Program. The Risk Committee regularly reviews reports from, and has discussions with, S&T’s Chief Risk Officer, or CRO, Chief Operating Officer, or COO, CSO, and Director of Operational Risk Management regarding cybersecurity risks, the threat landscape, updates on incidents and reports on our investments in cybersecurity risk mitigation and governance. The Risk Committee chairperson reports activities and recommendations with respect to such matters to the Board as are relevant and deemed appropriate by the Risk Committee. In the event of a material cybersecurity event, the CSO is responsible for promptly reporting such incidents to the CRO, executive management and the Board. A special meeting of the Board will be held, as deemed necessary by the Chairperson of the Board in consultation with the Chair of the Risk Committee. Management’s RoleAt the management level, the ERM Committee, CRO, COO, CSO, Director of Information Technology and Director of Operational Risk Management are responsible for assessing and managing material risks from cybersecurity threats. The ERM Committee reports information to the Risk Committee on a quarterly basis, or more often as needed.Risk Management leadership, which assists the ERM Committee in assessing and managing cybersecurity threats, include our CRO, COO, CSO, Director of Information Technology and Director of Operational Risk Management. Our CRO who oversees the risk management information security program reports to our CEO, but has direct access to the Risk Committee. Our CRO is a Certified Public Accountant, holds a Certification in Risk Management Assurance and has over 25 years of financial services experience. Our COO has over 20 years of banking technology and operations experience, including serving as head of digital for a business unit at a large national bank. Our CSO reports to the CRO and has 18 years of information technology and cybersecurity experience, including prior roles as chief information officer, assistant director of information technology, chief information security officer and chief security officer in federal law enforcement and banking organizations. Our Director of Information Technology has 25 years of information technology and cybersecurity experience. Our Director of Operational Risk Management has 11 years of information technology and cybersecurity experience, including serving as a former chief information officer for a financial institution.For more information regarding the risks associated with cybersecurity that may impact our business strategy, results of operations or financial condition, see “ Part I, “Item