Company: KEY-PI
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000091576-25-000038
Chunk: 201

Company: KEYCORP /NEW/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 201
---
 and is responsible for determining whether relevant security risk information is properly integrated into strategic and business decisions, overseeing the appropriate identification and ownership of security risks, monitoring critical risks, and maintaining the appropriate oversight and governance of information security through associated programs and/or standards. Our CISO has served in various roles in information technology and information security at Key for over 30 years, including serving as Enterprise Security Executive. The CISO holds a B.S.B.A in Management Information Systems.

The CISO is responsible for reporting on information security matters, including cybersecurity risk, to the Board. The CISO provides updates to the Audit Committee on cybersecurity matters at each regularly scheduled Committee meeting (six times in 2024). The CISO’s update to the Committee generally address the cybersecurity threat landscape, information security trends, strategic initiatives related to information security, and cybersecurity program reviews. The CISO also updates the Risk Committee on cybersecurity matters and on Key’s compliance with the Gramm-Leach-Bliley Act on an annual basis and presents the Information Security Policy for approval. The CISO, along with Key’s Deputy CISO, also report annually to the Technology Committee to obtain approval on Key’s Cyber Strategy and Investment Plan. The CISO provides updates to the Board as needs arise and from time to time.

44

Table of contents

Key’s Deputy CISO leads the Corporate Information Security function, including the Cyber Defense Center, Identity& Access Management Operations, Information Security Governance and Data Protection, and Security Architecture, Engineering and Platform Operations. The Deputy CISO has over 17 years of cybersecurity and technology risk management experience across financial services and retail, previously served as the Head of Information Security Governance within KeyCorp’s Corporate Information Security group, as well as the Head of Cybersecurity and Technology Risk Oversight within KeyCorp’s Risk Management group. He holds a bachelor’s degree in Finance and Management Information Systems and an MBA.The CISO reports to Key’s Chief Information Officer who oversees all of Key’s shared services for technology,operations, data, servicing, cyber and physical security, and corporate real estate solutions. Our Chief Information Officer, who has served in the role since 2012, has extensive experience overseeing technology and operations delivery for critical enterprise functions and has held various leadership roles during her over 30-year career in the financial services industry.At the management level, our Enterprise Risk Management (ERM) Committee, chaired by the Chief ExecutiveOfficer and comprising other senior level executives, including the Chief Information Officer, reports to the Board’sRisk Committee and is responsible for managing risk, including cybersecurity