Company: SFB
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000950170-25-027702
Chunk: 73

Company: STIFEL FINANCIAL CORP
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1B
Chunk 73
---
None.

ITEM 1C. CYBERSECURITYWe maintain an information security program and governance framework that are designed to protect our information systems against risks related to cybersecurity.Cybersecurity Risk Management and Strategy We define information security and cybersecurity risk as the risk that the confidentiality, integrity, or availability of our information and information systems are impacted by unauthorized or unintended access, use, disclosure, disruption, modification, or destruction. Information security and cybersecurity risk are incorporated into our comprehensive Enterprise Risk Management (“ERM”) program, which we use to identify, aggregate, monitor, report, and manage risks.The Written Information Security Program (“WISP”), our enterprise information security and cybersecurity program, is incorporated within the ERM program and led by our Chief Information Security Officer (“CISO”). The WISP is designed to (i) ensure the security, confidentiality, integrity, and availability of our information systems and data; (ii) protect against any anticipated threats or hazards to the confidentiality, integrity, or availability of such information and information systems; and (iii) protect against unauthorized access to information or information systems that could result in substantial harm or inconvenience to us, our associates, or our clients. The WISP is built upon a foundation of advanced security technology, a well-trained team of experts, and is designed to operate in alignment with applicable regulatory requirements. WISP deploys multiple layers of controls to identify, protect, detect, respond to, and recover from information security and cybersecurity incidents. These controls are measured and monitored by subject matter experts and a security operations center with integrated cyber detection, response, and recovery capabilities. The WISP includes our Incident Response program, which manages information security incidents involving compromises of sensitive information, and our Security Incident Response Plan (“SIRP”), which provides a documented framework for handling high severity cybersecurity incidents and facilitates coordination across multiple parts of the Company to manage response efforts. We also routinely perform simulations and drills around security matters at both a technical and management level, and our associates receive annual cybersecurity awareness training.The WISP incorporates reviews by our Internal Audit department and external third-party experts. Periodic independent third-party maturity assessments are conducted against the NIST Cyber Security Framework. Investments in threat intelligence, collaboration with peers, vulnerability management, incident response drills, and participation in industry and government forums are also part of our program.Cybersecurity risks related to third parties are managed as part of our System and Services Acquisition Policy, which sets forth the procurement, risk management, and contracting framework for managing third-party relationships commensurate with their risk and complexity