Company: CFG-PE
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0000759944-25-000013
Chunk: 480

Company: CITIZENS FINANCIAL GROUP INC/RI
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1
Chunk 480
---
 testing, and an independent audit. External organizations are also routinely engaged to assess our CSP and test our perimeter defenses. The effectiveness of the CSP is reported periodically to the appropriate governance committees.

Governance

Under the guidance of our CSO, we maintain a comprehensive CSP designed to protect our employees, customers, assets, premises, systems, and information against unauthorized access, misuse, alteration, or destruction that could result in substantial harm or inconvenience to our customers, and loss or reputational damage. The CSP incorporates all of our security policies and covers the core elements of access control, infrastructure security, cybersecurity event and incident management, data protection, third-party vendor cyber risk oversight, and training and awareness. Independent assessment and benchmarking of the CSP are regularly completed, and the CSP is reviewed and assessed by federal regulators. While we look to numerous frameworks to ensure the CSP is maintained in line with regulatory expectations and industry best practices, the National Institute of Standards and Technology cybersecurity framework is the primary standard against which we benchmark ourselves.Both the Risk and Audit Committees of our Board have oversight of the management of our cybersecurity risk. The Audit Committee is responsible for overseeing the CSP under its risk oversight responsibilities as it relates to financial controls. The Risk Committee is responsible for oversight of the management of cybersecurity risk consistent with the Framework.The CSP is presented by the CSO to the Risk Committee annually for approval in conjunction with an annual cybersecurity briefing. This briefing provides an overall assessment of the effectiveness of the CSP and an outlook for the upcoming year. In addition to the annual cybersecurity briefing, the CSO provides updates on cybersecurity to the Risk Committee at each of its meetings. The Audit Committee and Board also receive regular cybersecurity updates as part of the reporting provided by the Technology/Cyber Oversight Committee, a management committee chaired by the CEO which provides executive oversight, guidance and transparency to key transformative initiatives designed to enhance our technology stability, cyber defenses and risk management capabilities. Further, to ensure the Board maintains the appropriate knowledge for providing effective oversight, it is provided with relevant cybersecurity training on an annual basis, with any additional training provided as requested.

ITEM 2. PROPERTIES

We lease five operations centers in Boston, Medford, and Westwood, Massachusetts; Pittsburgh, Pennsylvania; and Glen Allen, Virginia. We own two principal operations centers in Johnston and East Providence, Rhode Island. At December 31, 2024, our subsidiaries owned and operated a total of 58 facilities and leased an additional 1,101 facilities. We believe our current facilities are adequate to meet our needs.