Company: ONBPP
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0000707179-25-000005
Chunk: 20

Company: OLD NATIONAL BANCORP /IN/
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1
Chunk 20
---
 for banking organizations related to significant computer security incidents. Under this rule, a bank holding company, such as Old National Bancorp, and a national bank, such as Old National Bank, are required to notify the Federal Reserve or OCC, respectively, within 36 hours of incidents that have materially disrupted or degraded, or are reasonably likely to materially disrupt or degrade, the banking organization’s ability to deliver services to a material portion of its customer base, jeopardize the viability of key operations of the banking organization, or pose a threat to the financial stability of the United States.

In July 2023, the SEC issued a final rule that requires registrants, including the Company, to (i) report material cybersecurity incidents on Form 8-K within four business days of their being deemed material; (ii) include updated disclosures in Forms 10-K about a registrant’s cybersecurity risk management and strategy, management’s role in assessing and managing material cybersecurity risks, and the board of directors’ oversight of cybersecurity risks; and (iii) present the disclosures in inline XBRL.

Safety and Soundness Standards. In accordance with the FDIA, the federal banking agencies adopted safety and soundness guidelines establishing general standards relating to internal controls, information systems, internal audit systems, loan documentation, credit underwriting, interest rate risk exposure, cybersecurity, liquidity, data protection, asset growth, asset quality, earnings, compensation, fees, and benefits. In general, the guidelines require, among other things, appropriate systems and practices to identify, monitor, and manage the risks and exposures specified in the guidelines. The guidelines prohibit excessive compensation as an unsafe and unsound practice and describe compensation as excessive when the amounts paid are unreasonable or disproportionate to the services performed by an executive officer, employee, director, or principal shareholder. In addition, regulations adopted by the federal banking agencies authorize, but do not require, an agency to order that an institution that has been given notice by an agency that it is not satisfying any of such safety and soundness standards to submit a compliance plan. If, after being so notified, the institution fails to submit an acceptable compliance plan or fails in any material respect to implement an accepted compliance plan, the agency must issue an order directing corrective actions and may issue an order directing other actions of the types to which an undercapitalized institution is subject under the “prompt corrective action” provisions of FDIA. If the institution fails to comply with such an order, the agency may seek to enforce such order in judicial proceedings and to impose civil money penalties and cease and des