Company: CVBF
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029985
Chunk: 84

Company: CVB FINANCIAL CORP
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1
Chunk 84
---
 Company. The Company has adopted a Nasdaq compliant clawback policy which is included as an exhibit with this Annual Report on Form 10-K.  

Cybersecurity and Data Breaches 

Federal regulators have issued multiple statements regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised customer credentials, including security measures to reliably authenticate customers accessing internet-based services of the financial institution. In addition, a financial institution’s management is expected to maintain sufficient business continuity planning processes to ensure the rapid recovery, resumption and maintenance of the institution’s operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or one of its critical service providers fall victim to a cyber-attack. Effective May 1, 2022, banking organizations are required to notify their primary banking regulator within 36 hours of determining that a “computer-security incident” has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, the banking organization’s ability to carry out banking operations or deliver banking products and services to a material portion of its customer base, its businesses and operations that would result in material loss. If we fail to observe the regulatory guidance, we could be subject to various regulatory sanctions, including financial penalties.  

State regulators have also been increasingly active in implementing privacy and cybersecurity standards and regulations. Recently, a number of states, notably including California where we conduct substantially all our banking business, have adopted laws and/or regulations requiring certain financial institutions to implement cybersecurity programs and providing detailed requirements with respect to these programs, including data encryption requirements. Many such states have also implemented or modified their data breach notification and data privacy requirements, including California and New York. We expect this trend of state-level activity in those areas to continue, and we continue to monitor relevant legislative and regulatory developments in California and other states in which our customers are located or in which we conduct business.  

In the ordinary course of business, we rely on electronic communications and information systems, as well as certain third-party service providers’ electronic communication and information systems, to conduct our operations and to store sensitive data. We employ a layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced