Company: FCNCB
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000798941-25-000010
Chunk: 113

Company: FIRST CITIZENS BANCSHARES INC /DE/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 113
---
 Analysis Center, the Financial Services Sector Coordinating Council, the Federal Bureau of Investigation, and the U.S. Department of Homeland Security. BancShares also utilizes external experts and third-party assessors to maximize its risk intelligence coverage and to enhance risk detection and remediation. BancShares engages internal auditors, external assessors, and consultants to benchmark, scale, manage, and identify cybersecurity threats. Consultants also assess BancShares’ cybersecurity systems and complete vulnerability testing. 

The BancShares information security program continues to operate under heightened awareness due to industry threats and recent acquisitions. For more information regarding the risks we face from cybersecurity threats, refer to Item 1A. Risk Factors. Thus far, there have been no cybersecurity incidents that we have determined to have materially affected or to be reasonably likely to materially affect us, including with respect to our business, results of operations, or financial condition. The focus continues to be on monitoring the threat landscape and integration of entities.   

GovernanceThe Board retains supervisory oversight responsibility for the organization and its activities, including enterprise risk management and cybersecurity risks. The Board conducts oversight of management through board committees, presentations from senior leadership, and routine Board-directed reporting to ensure management continues to operate and conduct business in alignment with Risk Appetite Statements. Oversight of cybersecurity and the ECSO organization is the responsibility of the Risk Committee. The Risk Committee oversees cybersecurity and other risks through reporting from management, including the Enterprise Risk Oversight Committee (“EROC”), as well as additional management-level subcommittees beneath the Risk Committee including the Technology & Security Risk Committee (“TSRC”) and the Operational Risk Committee (“ORC” and, together with the EROC and TSRC, the “Management Committees”). Management Committees, which include as members the CISO and other cybersecurity leadership, have clear lines of communication with the Board and its committees. The Management Committees are designed with a purpose-driven scope and decision-making authority and are required to provide the Board with regular reporting of management’s business activities and the potential risk associated with those activities. Management Committees are informed by EIM following the incident management process as per internal policies and standards. The Board may from time to time create informal working groups to enable deeper and more detailed discussions related to our technology needs and investments and inform the Board on cybersecurity risks, among other topics.In addition, the Audit Committee of the Board monitors internal audit’s coverage of cybersecurity governance, risks, and related controls, including any identified deficiencies, that could adversely affect the ability to record, process, summarize, and report financial data. The Risk Committee