Company: RNST
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000715072-25-000054
Chunk: 77

Company: RENASANT CORP
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 77
---
 cybersecurity best practices as well as a course specifically related to social engineering, email and social media security. The Company also conducts routine internally-focused exercises to help raise employee awareness of the risks associated with cybersecurity. For example, over the course of 2024, employees received at least one email per quarter designed to test employees’ ability to identify and avoid potential “phishing” emails, and those employees that fail this phishing test are assigned additional training. In addition, annually the Company’s incident 

30

response team engages in a cyber attack tabletop exercise designed by the Financial Services Information Sharing and Analysis Center that helps to train the incident response team in overcoming a simulated attack against Renasant’s payment systems and processes.

Governance and Oversight

Management Role.  The Company takes a layered approach to the governance of its cybersecurity risk management. The first line of defense against cybersecurity risk is the company’s information security team, led by the CISO. This team is primarily responsible for promptly identifying cybersecurity risks associated with our existing and anticipated operations and, once identified, assessing the level that each cybersecurity risk poses to us, and then controlling or mitigating to the extent reasonably possible (in the context of the Company’s operations and resources, and competitive factors affecting how banks and other financial services companies conduct operations, among other things).

The efforts of our information security team to address cybersecurity risk are reviewed by the Company’s Risk Department, which oversees our enterprise risk management program. The department focuses on the quality of the Company’s risk management process in order to manage risks within acceptable tolerance levels. As it pertains to cybersecurity risk, the Risk Department challenges the processes that the information security team has implemented to identify, assess, control and mitigate cybersecurity risk. The department collaborates with the CISO and other business unit owners impacted by our cybersecurity risk management practices to develop and monitor controls and other processes that mitigate identified risks. In addition, the Risk Department conducts independent risk evaluations related to cybersecurity risk.  The primary means by which the Risk Department evaluates cybersecurity risk is the development, in conjunction with the information security team, of risk metrics related to cybersecurity as well as risk tolerances with respect to each such metric. Risk tolerances are set such that the overall cybersecurity risk presented to us is consistent with the risk appetite statement adopted by our Board annually. Management believes these metrics provide a holistic picture of the Company’s cybersecurity risk profile, but at the same time, we recognize that, given the continual evolution of cybersecurity risks, including the tools and vectors that bad actors take to compromise a company’s information security