Company: SFNC
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001628280-25-008639
Chunk: 78

Company: SIMMONS FIRST NATIONAL CORP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 78
---
 KRIs related to cyber risk (which are a subset of operational risk KRIs) are reported to, and overseen and monitored by, our enterprise risk management committee, which is comprised of senior executives of the Company. Additionally, we maintain an incident response framework that details the applicable teams, their functions, and guidelines when a cybersecurity incident occurs. The framework is designed to cover significant aspects of the incident including detection, containment, remediation, and post incident analysis. Various groups of senior executives help oversee responses to security incidents, including the data loss prevention team, the core computer security incident response team, and the extended computer security incident response team.While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are constant, and, like other financial institutions, we, as well as our customers, employees, and third-party service providers, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber-attacks. We continue to assess the risks and changes in the cyber environment, reasonably invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities. See the risk factor “Our business is heavily reliant on information technology systems, facilities, and processes; and a disruption in those systems, facilities, and processes, or a breach, including cyber-attacks, in the security of our systems, could have significant, negative impacts on our business, result in the disclosure of confidential information, and create significant financial and legal exposure for us.” in “Item 1A. Risk Factors” of this Form 10-K for more information.

32

Governance

Our board of directors is aware of, and takes seriously, the importance of overseeing risks associated with cybersecurity threats. Senior management has provided the board of directors with cybersecurity information, as well as incident response training. Additionally, employees have received training related to cybersecurity. Cyber risks are incorporated into risk appetite metrics for operational risk and presented to and reviewed by the risk committee of the board of directors. Additionally, the audit committee of the board of directors receives and reviews internal audit reports concerning, among other things, matters related to information security. Furthermore, the board of directors of Simmons Bank, the Company’s primary operating subsidiary, has established an information technology committee (“IT Committee”) that receives regular reports from the CISO and CIO concerning our information security program and cybersecurity matters. The CIO also reports IT KRIs, including those related