Company: BANC-PF
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001628280-25-009438
Chunk: 510

Company: BANC OF CALIFORNIA, INC.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 510
---
 a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations, or financial conditions. Our internal systems, processes, and controls are designed to mitigate and minimize potential losses resulting from cyber-attacks, however, there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. For further discussion of risks from cybersecurity threats, see Item 1A. Risk Factors in the section titled “We are subject to certain risks in connection with our use of technology.”

52

Governance

Our Board of Directors considers cybersecurity risk as part of its risk management function and has delegated to the Enterprise Risk Committee oversight and governance of the technology program and the information security program, including management’s actions to identify, assess, mitigate, and remediate or prevent material cybersecurity issues and risks. The Enterprise Risk Committee reviews our cybersecurity risk profile on a quarterly basis. Additionally, our CISO and our Chief Information Officer provide quarterly reports to the Enterprise Risk Committee regarding the information security program and the technology program, key enterprise cybersecurity initiatives, and other matters relating to cybersecurity processes.

The Information Technology and Information Security sub-committee is a sub-committee of the management level Enterprise Risk Management Committee and is represented by managers within various departments and includes the CISO, the Chief Technology Officer ("CTO"), and the Chief Information Officer ("CIO") and other key departmental managers from throughout the entire company. This sub-committee meets quarterly to provide oversight of the technology management strategy, standards, policies, practices, controls, and mitigation and prevention efforts employed to manage security risks. Meetings with key team leaders occur as required and in accordance with the IRP in order to facilitate timely informing and monitoring efforts. The Company's Executive Leadership Team meets monthly with the CISO, CIO, and CTO and reports summaries of key issues, including significant cybersecurity and/or privacy incidents, discussed at various meetings and responses to any actions taken to/from the Enterprise Risk Committee on a quarterly basis or more frequently as may be required by the IRP.

Our CISO has substantial relevant expertise and formal training in the areas of information security and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our information security program. The responsibilities of this department include cybersecurity risk assessment, defense operations, incident response, vulnerability assessment, threat intelligence, identity access governance, third-party risk management, client, vendor and employee education and awareness, and business continuity and disaster recovery.