Company: ASB
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000007789-25-000013
Chunk: 208

Company: ASSOCIATED BANC-CORP
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1C
Chunk 208
---
ITEM 1C.Cybersecurity

Risk Management and StrategyThe Corporation recognizes the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Corporation. The Corporation's Information Security Program establishes policies and procedures for the measurement of the effectiveness and efficiency of information security controls related to both design and operations. The Corporation leverages the following guidelines and frameworks to develop and maintain the Information Security Program: FFIEC Information Security IT Examination Handbook, FFIEC Business Continuity Planning Handbook, FFIEC Cybersecurity Assessment Tool, Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Cybersecurity Framework, National Institute of Standards and Technology Special Publication 800 Series, ISO-27000 Standard and GLBA 501(b). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these guidelines and frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. In general, the Corporation seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on confidentiality, security and availability of the information that the Corporation collects and stores by identifying, preventing, and mitigating cybersecurity threats and effectively responding to cyber threats when they occur.Among other things, the Information Security Program is focused on the following key areas:•Security Operation and Governance: As discussed in more detail under the heading “Governance,” senior management carries out this mandate through the Operational Risk and Enterprise Risk Management Committees. To maintain alignment and appropriate insight regarding information security activities, an Information Security Steering Committee provides general program insight. •Collaborative Approach: The Corporation has implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.•Security Competencies: The Information Security organization oversees a program of security competencies and tools designed to protect the confidentiality, integrity, and availability of our data. These assets represent a blend of various management (e.g., policies), operational (e.g., standards and processes), and technical controls (e.g., tools and configurations).•Cyber Defense Center and the Incident Response Plan: The Corporation has a Security Operations Center, known as the “Cyber Defense Center,” which provides continual security monitoring 24 hours per day, seven days per week, where resources deliver threat analysis, vulnerability management, intrusion detection, intrusion hunting