Company: ONBPP
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0000707179-25-000005
Chunk: 76

Company: OLD NATIONAL BANCORP /IN/
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 76
---
 and cybersecurity control testing. He is a frequent lecturer and author on information security and technology risk topics and maintains his Certified Information Security Manager (CISM) and Certified Data Privacy Solutions Engineer (CDPSE) certifications through the Information Systems Audit and Control Association, Inc. (ISACA).Cybersecurity risks and updates are reported and discussed on a regular basis within various Old National and Old National Bank management committees that have operational business or information technology oversight or day-to-day implementation, monitoring, and governance responsibility for information security matters. Those include Old National Bank-level committees such as the Information Security and Technology Risk Management Committee (the “ISTRM”), the Risk Executive Committee, the Security Technology Council and the Cyber Threat Management Council. The ISTRM has direct oversight of the ISP. It is chaired by the CISO and meets regularly (generally bi-monthly and no fewer than five times per year) to review the ISP and related cybersecurity matters as outlined in its charter. Members of the ISTRM and the other referenced management committees include the CRO, the CISO, the Chief Information Officer, key senior business operating managers and functional leaders, and other representatives from the Company’s Information Security department. Coordination among these committees, and with other business management committees operating outside the auspice of the Company’s Information Security or Enterprise Risk departments, is intended to help Old National address information security questions in a consistent, coordinated fashion, maintain front-line visibility of the ISP, and promote compliance with Old National security policies and standards. The Enterprise Risk Committee of the Company’s Board of Directors (the “Risk Committee”) is responsible for oversight of the Company’s enterprise-wide risks as set forth in its charter. That includes oversight of management’s actions designed to identify, assess, mitigate, and prevent or remediate material cybersecurity issues and risks, through the ISP and other activities. The CISO provides quarterly (or more frequent, as appropriate) reports to the Risk Committee and the Risk Executive Committee, along with periodic reporting to the full Board of Directors on the ISP, the ISTRM’s activities, key enterprise cybersecurity initiatives, and other matters relating to the Company’s cybersecurity profile and risks. The Risk Committee provides a report to the full Board of Directors at each regular Board meeting regarding the Risk Committee’s risk oversight activities, including those relating to cybersecurity, and the Company maintains procedures for the CRO and/or CISO to escalate significant cybersecurity matters to the Risk Committee, Executive Committee, and/or the full Board of Directors, as appropriate.

Notwithstanding the extensive approach we take to