Company: BPOPM
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0001193125-25-043848
Chunk: 67

Company: POPULAR, INC.
Filing Date: 2025-03-03
Form: 10-K
Item: Item 5
Chunk 67
---
 base,
jeopardize the 
viability
of
key
operations
of
the
banking
organization,
or
impact
the
stability
of
the
financial
sector.
The
final
rule
also
requires 
specific and immediate notifications by bank
service providers that become aware of similar
incidents. 
State and foreign regulators
have also been increasingly active
in implementing privacy and cybersecurity
standards and 
regulations. Several states have adopted regulations requiring certain financial institutions to implement cybersecurity programs and 
providing detailed requirements with respect to these
programs, including data encryption requirements. In New York,
the NYSDFS 
requires
financial
institutions
regulated
by
the
NYSDFS,
including
PB,
to,
among
other
things,
(i)
establish
and
maintain
a 
cybersecurity program designed
to enhance the
confidentiality, integrity
and availability of
their information systems;
(ii) implement 
and maintain a written
cyber security policy setting forth
policies and procedures for the
protection of their information systems
and 
nonpublic
information;
and
(iii)
designate
a
Chief
Information
Security
Officer.
On
November
1,
2023,
the
NYSDFS
adopted 
amendments to
its
cybersecurity regulations
that
represent
a
significant
update
to
the
regulation of
cybersecurity practices.
The 
amendments
generally
fall
within
the
following
five
categories:
(i)
increased
mandatory
controls
associated
with
common
attack 
vectors,
(ii)
enhanced
requirements
for
privileged
accounts,
(iii)
enhanced
notification
obligations,
(iv)
expansion
of
cyber 
governance practices and (v) additional cybersecurity
requirements for larger companies.
On
July
6,
2023,
the
SEC
adopted
new
rules
that
would
require
registrants,
such
as
Popular,
to
(i)
report
material 

  21 
cybersecurity incidents
on Form
8-K and,
(ii) disclose
in Annual
Report on
Form 10-K
cybersecurity policies
and procedures
and 
governance practices, including at the board and
management levels. 
Many states and foreign
governments have also recently implemented