Company: FITBI
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000035527-25-000079
Chunk: 413

Company: FIFTH THIRD BANCORP
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 413
---
 section of Item 7 (Management’s Discussion and Analysis of Financial Condition and Results of Operations) of this Annual Report for additional information on the Bancorp’s Enterprise Risk Management Framework and related risk management processes.In light of the complexity and evolving nature of the cybersecurity landscape, the Bancorp periodically re-assesses the maturity of its cybersecurity programs, policies and procedures, including in some instances by engaging the assistance of external experts. The Bancorp also conducts exercises to test its incident response plans and threat assessments, some of which also involve assistance from external consultants.The Bancorp also maintains a Third Party Risk Management Program to perform similar functions related to risks associated with the Bancorp’s relationships with third parties. This assists the Bancorp in its management of its relationships with third parties, which includes considerations for identifying, analyzing and monitoring the cybersecurity risks that third parties may present to Fifth Third. The Bancorp also maintains a third-party incident response program to govern its response in the event of third-party cybersecurity events.

Board of Directors Oversight

The Technology Committee of the Bancorp’s Board of Directors takes primary responsibility for overseeing the Bancorp’s information security programs at the Board level. The Technology Committee’s primary purpose is to assist the Board of Directors in its oversight of plans and operations related to information technology, cybersecurity, data privacy and third-party technology strategy.The Bancorp’s Risk and Compliance Committee of the Board of Directors oversees the Bancorp’s Enterprise Risk Management Framework and policies, including oversight of risks related to information security. The Risk and Compliance Committee receives periodic reports from the Technology Committee and these committees meet jointly at least once per year to discuss the Company’s programs and risks. 

The full Board of Directors receives reports from the Technology Committee and the Risk and Compliance Committee about the Bancorp’s cybersecurity programs as a result of the above-described oversight. In the event of a material cybersecurity incident, the Bancorp’s incident response procedures include notifications to the Technology Committee, Risk and Compliance Committee and full Board of Directors, when appropriate and necessary. 

39 Fifth Third Bancorp

Table of Contents 

Management Oversight

The Bancorp’s Information Security Governance Committee (“ISGC”) is a management committee that reviews and discusses critical information security risks that impact the Bancorp, identifies solutions to address these risks and has oversight of the Bancorp’s information technology and information security policies. The ISGC provides cybersecurity reports periodically to the Risk and Compliance Committee and is comprised of the Bancorp’s senior information security, information technology and enterprise risk management leaders, including the Chief Information Security Officer (“CISO”), Chief Information Officer