Company: WBS-PG
Filing Date: 2025-03-03
Form Type: 10-K
Source: 0000801337-25-000004
Chunk: 225

Company: WEBSTER FINANCIAL CORP
Filing Date: 2025-03-03
Form: 10-K
Item: Item 1C
Chunk 225
---
 and security updates.“Zero trust principles” drive the Company’s information security architecture, and the Company deploys a “defense in-depth” strategy to protect against cybersecurity threats, layering multiple levels of information security and technology controls within business processes for information assets and relationships with third parties based on the National Institute of Standards and Technology Special Publication 800-53 Framework. The Company’s information systems and risk management are also subject to regulatory requirements and examination by federal banking regulators.The identification of control weaknesses and vulnerabilities affecting information assets and/or relationships with third parties allows the Company to mitigate risk from, and respond to, cybersecurity threats. Initial risk assessments are performed upon the acquisition, or as part of the development of, information assets in order to evaluate the inherent risk associated with network and host environments and assess the adequacy of implemented technology operation processes and controls. Risk and control self-assessments are conducted on an annual basis to identify gaps resulting from any process changes that occurred during the year, and to evaluate whether the levels of cybersecurity risk remain within the tolerance set in the Company’s Risk Appetite Statement or whether a risk needs to be mitigated.Due diligence is performed prior to onboarding all third parties with access to the Company’s information assets to ensure such parties maintain security controls contractually required by the Company as part of its Third Party Risk Management Program. The Company provides ongoing monitoring, including cybersecurity maturity assessments, of third parties using a risk-based approach to determine the extent and frequency of periodic assessments. Semi-annual cybersecurity maturity assessments are conducted by the Company’s Corporate Information Security team on its information systems using industry-standard guidelines and tools, including the National Institute of Standards Cybersecurity Framework, the Federal Financial Institutions Examination Council Cybersecurity Assessment Tool, and the Center for Internet Security Critical Security Controls.Because cybersecurity threats continue to evolve, thereby increasing inherent risk, the Company’s Corporate Information Security team is augmented by contracted external managed security service providers, who collectively work 24/7 to monitor cybersecurity threats through processes such as endpoint and network security, email protection, data loss prevention, vulnerability scanning and mitigation, identity and access management, logging and monitoring, and threat hunting. Independent third parties test the Company’s cyber capabilities and audit its cloud security. The Company regularly tests its systems to discover and address any potential vulnerabilities. Senior and Executive management also participate in cybersecurity industry collaboration and information-sharing forums and utilize the information gained to drive protective and detective cybersecurity strategies and tactics.

27

Table of Contents

The Company requires information security education, training at the time of hire, and annually thereafter,