Company: WAL-PA
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001212545-25-000090
Chunk: 76

Company: WESTERN ALLIANCE BANCORPORATION
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 76
---
 as well as to monitor compliance with the Company’s security polices, applicable laws and regulations. As an ongoing operation, the Company’s SMC, which is part of the CISO organization, manages the security of our systems through the ingestion of multiple external threat feeds and systems logs. Through the collection and integration of security-related IT infrastructure information, external threat intelligence and the expertise of trained SMC analysts, the Company works to identify and address potential indicators of compromise. Potential security events are identified and addressed through defined IT incident response activities, the SMC’s oversight through SIEM, and with support of the Company’s CSR Plan. The CSR Plan is in place and updated regularly with the intent to reduce impacts to clients and the Company caused by a declared cyber incident, such as an event involving malicious code, unauthorized disclosure, loss of information or unauthorized use of information or systems. The CSR Plan organizes resources to detect, manage, respond to, resolve and recover from events that harm or threaten the security of information assets. The CSR plan includes involvement of the Company’s Executive Leadership Team and BOD based on the severity of a cyber event, including the analysis of reporting requirements. The CSR plan is tested annually and includes technical and executive management in simulated crisis management cybersecurity tabletop exercises.Cyber threat actors and cybersecurity incidents are a reality and the Company and our third parties face cybersecurity threats in the normal course of business. As of the date of this report, we are aware of the incident described in Item 9B “Other Information” of this report and, as of the date of this report, we have not experienced material losses or consequences relating to material cybersecurity incidents experienced by us or our third parties. However, we expect businesses will continue to experience cybersecurity risks that could result in adverse impacts with increased frequency and severity due to the evolving threat environment, and there can be no assurance that future cybersecurity incidents, including incidents experienced by third parties, will not have a material adverse impact on the Company, including its business strategy, results of operations and/or financial condition. Future cybersecurity threats and incidents could have a material impact on our service, systems or business and are discussed in “Risk Factors” to this report.