Company: UVSP
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000102212-25-000006
Chunk: 141

Company: UNIVEST FINANCIAL Corp
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1B
Chunk 141
---
 and control decisions, service provider arrangements, results of testing, security breaches or violations are discussed as are management’s responses and any recommendations for program changes.

Program Adjustments. The CISO monitors, evaluates, and adjusts the Information Security Program considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.

Incident Response Plan.  To ensure that information security incidents can be recovered from quickly and with the least impact to the Corporation and its customers, the Corporation maintains a structured and systematic incident response plan (the "IRP") for all information security incidents that affect any of the IT systems, network, or data of the Corporation, including the Corporation's data held, or IT services provided, by third-party vendors or other service providers. The CISO is responsible for implementing and maintaining the IRP, which includes:

a.Identifying the incident response team ("IRT") and any appropriate sub-teams to address specific information security incidents, or categories of information security incidents.

b.Coordinating IRT activities, including developing, maintaining, and following appropriate procedures to respond to and document identified information security incidents.

c.Conducting post-incident reviews to gather feedback on information security incident response procedures and address any identified gaps in security measures.

d.Providing training and conducting periodic exercises to promote employee and stakeholder preparedness and awareness of the IRP.

e.Reviewing the IRP at least annually, or whenever there is a material change in the Corporation's business practices that may reasonably affect its cyber incident response procedures.

Notwithstanding our defensive measures and processes, the threat posed by cyber-attacks is significant. For further discussion of risks from cybersecurity threats, see the section captioned "The Corporation's information technology systems, and the systems of third parties upon which the Corporation relies, may experience a failure, interruption or breach in security, which could negatively affect our operations and reputation." in Item 1A. Risk Factors.

24