Company: UVSP
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000102212-25-000006
Chunk: 138

Company: UNIVEST FINANCIAL Corp
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1B
Chunk 138
---
Item 1B.      Unresolved Staff Comments

None.

Item 1C.      Cybersecurity Risk Management, Strategy and Governance

Cybersecurity is a significant and integrated component of the Corporation's risk management strategy. As a financial services company, cyber threats are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. Through December 31, 2024, the Corporation has not, to its knowledge, experienced a cybersecurity incident materially affecting or reasonably likely to materially affect the Corporation. 

The structure of our information security program is generally designed around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. To prepare and respond to incidents, the Corporation has implemented a multi-layered cybersecurity strategy, integrating people, technology, and processes. This includes employee training, the use of innovative technologies, and the implementation of policies and procedures in the areas of Information Security, Data Governance, Business Continuity and Disaster Recovery, Privacy, Third-Party Risk Management, 

22

Table of Contents

and Incident Response. The Corporation engages third-party consultants and independent auditors to, among other things, conduct penetration tests and perform cybersecurity risk assessments and audits.

The Information Security Department of the Corporation is primarily responsible for identifying, assessing and managing material risks from cybersecurity threats. The Information Security Department is managed by the Board-appointed Chief Information Security Officer (the "CISO") who reports directly to the Corporation's Chief Risk Officer. The CISO has over 40 years of experience in various aspects of information technology ("IT") from field support to software development to management. Prior to joining the Corporation, the CISO held management roles of increasing responsibility in a variety of regulated industries including food, pharma, and manufacturing. The CISO holds a Bachelor of Science Degree in Computer Science and has earned a certificate in Cybersecurity Oversight from the National Association of Corporate Directors. The CISO also oversees the Corporation's Information Security Program, which is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity and physical asset classification and control policies. The Information Security Program identifies data sources, threats and vulnerabilities and ensures awareness, accountability, and oversight for data protection throughout the Corporation and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster). The Information Security Department conducts ongoing technology and IT threat meetings to ensure the latest threats are addressed in addition to penetration