Company: KEY-PI
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000091576-25-000038
Chunk: 202

Company: KEYCORP /NEW/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 202
---
 risk. The ERM Committee serves as asenior level forum for review and discussion of material operational risk issues, including cybersecurity risk, andreceives regular updates from the CISO regarding cybersecurity risk. The ERM Committee directly oversees theOperational Risk Committee, which provides governance, direction, oversight, and high-level management ofoperational risk, including cybersecurity risk, and includes senior management representation from the LOB andsupport areas. The CISO is a voting member of the Operational Risk Committee.The Operational Risk Committee also includes subcommittees which, among other things, address security issuesand concerns, pursue security-related program enhancements, address fraud trends, provide input on fraudstrategy, weigh the impacts of fraud risk on customers, business clients, and the LOB, and cascades awareness offraud risks across Key.Key also has a Privacy Team led by a Chief Privacy Officer (CPO) who has over ten years of experience in legal,compliance, and risk roles at financial institutions, focusing primarily on data protection and privacy. Our CPO holdsan undergraduate degree in finance, a master’s degree in business administration, and a juris doctorate. He islicensed to practice law in the state of Ohio and has obtained the CIPP/US certification through the InternationalAssociation of Privacy Professionals. The CPO and Privacy team have the authority to escalate privacy risks to theBoard. The Privacy and Information Security teams work together to implement controls around how personallyidentifiable information is managed and protected and to comply with applicable laws and regulations.

Cybersecurity Incidents

When a cybersecurity incident is identified, we follow established processes in our enterprise privacy and cyber

incident response plans, which are a supplement to our corporate incident response plan. These plans provide a

framework to enable the appropriate personnel to recover operations in the event of a cyberattack and manage

incidents impacting banking information, including our clients’ and employees’ information.

Our Core Incident Response Rapid Emergency Assessment and Coordination Team (Core IR REACT) is

responsible for responding to incidents, including cyberattacks, performing a preliminary assessment, and engaging

additional support team members as necessary. The Core IR REACT team is a multidisciplinary team that is

empowered to escalate issues, as appropriate, to our Crisis Management Team (CMT), which includes the CEO

and senior executives from Key’s LOB and major support areas. The CMT provides overall strategic

direction for incident responses and recovery. Incidents are also reported internally to key stakeholders through Key’s risk governance committee structure.

As discussed above