Company: STBA
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000719220-25-000013
Chunk: 121

Company: S&T BANCORP INC
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 121
---
Item 1C. CYBERSECURITY

Risk Management and Strategy

S&T’s Information Security Program provides policies, procedures, controls and technical measures to assess, identify and manage material cybersecurity risks. The Information Security Program is a part of S&T’s overall Enterprise Risk Management, or ERM Program. The Information Security Program is designed to achieve the following objectives:•protecting data through the use of automated and manual processes;•periodically assessing and updating the program to address an evolving threat environment;•maintaining a team of IT security professionals that continually monitor, detect, analyze, investigate and report cybersecurity threats; and•ensuring business continuity and disaster recovery.We based and tailored our framework on the National Institute of Standards and Technology, or NIST, Cybersecurity Framework and the Center for Internet Security, or CIS, Critical Security Controls.The S&T Information Security Program utilizes a defense in depth strategy that leverages multiple security measures to protect the bank's assets. We encrypt and leverage data loss prevention technology for sensitive data and use advanced transport layer security encryption for our applications. S&T employees are required to undergo annual information security awareness training, which includes information regarding evolving threats such as phishing, malware and social engineering testing.S&T performs periodic risk assessments that seek to identify both technical and physical risks to information systems. The assessments incorporate cybersecurity-related principles from the Federal Financial Institutions Examination Council, or FFIEC, Information Technology Examination Handbook, regulatory guidance and concepts from other industry standards, including the NIST Cybersecurity Framework. An assessment typically includes:•identifying reasonably foreseeable internal and external threats that could result in a cybersecurity incident;•assessing the likelihood and potential impact of those threats; and•assessing the sufficiency of policies, procedures, practices, and technical measures in place to manage risks.In addition to periodic risk assessments, S&T evaluates changes to IT systems or physical systems for any information security impacts. S&T utilizes staff and independent third parties to conduct annual penetration testing and IT security health assessments. We engage third parties to facilitate tabletop incident response and business continuity exercises. Additionally, we participate in various cybersecurity industry forums and have access to law enforcement analysis regarding current threats. Our third-party risk management program is integrated into our Information Security Program within our ERM Program. The policies, procedures and practices applicable to the cybersecurity components of the third-party risk management program were developed and are maintained consistent with the FFEIC IT Examination Handbook, as well as guidance from our prudential regulators. We perform a risk assessment, including cyber threats, associated