Company: WSBC
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000950170-25-030795
Chunk: 154

Company: WESBANCO INC
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 154
---
 incidents.  In addition to handling critical incidents, the response team coordinates an annual tabletop exercise aimed at continually practicing documented incident response processes.  These tabletop exercises include participation from executive leadership and periodically members of the board of directors.  The Incident Response team is chaired by the Chief Security Officer and membership of the Incident Response team includes representation from Human Resources, Information Technology, Fraud and BSA, Corporate Communications, Risk Management, Investor Relations, Retail Banking, Compliance, Bank Operations, Legal Counsel, Customer Support, and Digital Banking and Payments.Governance​Cybersecurity threats, a security strategy roadmap, and key risk indicators are shared with management and the board of directors through both committee reporting structures and periodic reports of the Chief Security Officer. In addition, management updates our Enterprise Risk Management Committee, as necessary, regarding significant cybersecurity incidents. Our Enterprise Risk Management Committee regularly reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The Technology Governance Committee, a management level steering committee also receives periodic reports from the Chief Security Officer for security risk assessments, security program effectiveness evaluations, occurrence and response to cyber incidents, effectiveness of mitigation strategies, regulatory compliance, and external assessments and benchmarking.  As part of the Enterprise Risk Management Framework, cybersecurity oversight also utilizes the concept of three lines of defense which allows for multiple challenge response processes to continually mature the cybersecurity program. Cybersecurity best practices from the National Institute of Standards and Technology ("NIST") and the Center for Internet Security ("CIS") are used to establish, operate, and validate security controls. The Enterprise Risk Management Committee is a board-level committee focusing on enterprise risk, including cybersecurity risks. Multiple directors have decades of experience, not only in the banking sector, but also have been responsible for cybersecurity and technology departments at larger organizations.  The Chief Security Officer is responsible for providing the Information Security strategy and operational planning for the overall Information Security program, and has decades of experience in the industry, advanced education degrees, and holds industry standard technical and security certifications.  Several members of the Information Security team also hold multiple security certifications that tie directly to their job responsibilities.  These certifications include, but are not limited to, ISC2 Certified Information Systems Security Professional (CISSP), ISACA Certified Information Systems Auditor (CISA), ISACA Certified Information Security Manager (CISM), EC-Council Certified Ethical Hacker (CEH), CompTIA Security+, CompTIA CySA+, CompTIA CASP+, and CompTIA PenTest+.While Wesbanco and its third-party