Company: SFNC
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001628280-25-008639
Chunk: 77

Company: SIMMONS FIRST NATIONAL CORP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 77
---
ITEM 1C.  CYBERSECURITY

We maintain an information security program and governance structure for assessing, identifying, and managing material risks from cybersecurity threats.Risk Management and StrategyOur information security program is led by our chief information security officer (“CISO”), who has over 25 years of experience in technology management, has 9 years of banking experience, and is a certified information systems security professional. The CISO oversees our “information security team” within our information technology department, which includes our identity and access management group, our security operations center group, and our security engineering and security architecture groups. These groups develop, deploy, monitor, and manage multiple processes, systems, and controls, including embedded controls within the technology we use, designed to help identify, protect against, detect, respond to, and recover from cybersecurity threats and incidents.In addition to our information security team, we also employ a senior vice president of IT governance and risk who has over 18 years of IT governance, risk, and compliance experience and is responsible for the development, monitoring, and reporting of IT-related key risk indicators (“KRIs”), including KRIs related to cyber risks. Both our CISO and our senior vice president of IT governance and risk report to our chief information officer (“CIO”), who has more than 25 years of technology leadership experience, including leadership experience at global financial institutions, and is responsible, among other things, for oversight of our information technology environment, strategy, and security risks.As part of our information security program, we undertake efforts to monitor new and emerging risks and evaluate the effectiveness and maturity of our cyber defenses through various means, including internal audits, targeted testing (including penetration testing), incident response exercises, maturity assessments, and industry benchmarking. In connection with these efforts, we use, on an as-needed basis, certain third-parties, including auditors, consultants, and others, that have particular cyber expertise.We also maintain multiple groups that help oversee risks associated with our third-party service providers. These groups include (1) our third-party risk management department, which facilitates reviews of certain third parties by our assurance providers, including our information security and business continuity teams, (2) our vendor council, which reviews contractual terms (including, at times, terms related to confidentiality and data protection) for certain third-party relationships, and (3) our architecture review board, which reviews certain new business initiatives that may impact the Company’s technical and/or security architecture.Our information security program is one component of our broader enterprise risk management program. As such,