Company: TCBI
Filing Date: 2025-02-11
Form Type: 10-K
Source: 0001077428-25-000036
Chunk: 140

Company: TEXAS CAPITAL BANCSHARES INC/TX
Filing Date: 2025-02-11
Form: 10-K
Item: Item 1C
Chunk 140
---
ITEM 1C.    CYBERSECURITY

Cybersecurity Risk Management and Strategy

Cybersecurity risks are constantly evolving and becoming increasingly pervasive across all industries. To mitigate these risks and protect sensitive customer data, financial transactions and the Company’s information systems, the Company has 

29

implemented a comprehensive cybersecurity risk management program, which is a component of its overarching enterprise risk management program. Key components of the cybersecurity risk management program include:•A risk assessment process that identifies and prioritizes material cybersecurity risks; defines and evaluates the effectiveness of controls to mitigate the risks; and reports results to executive management and the Board of Directors.•A third-party Managed Detection and Response (“MDR”) service, which monitors the security of the Company’s information systems around-the-clock, including intrusion detection and alerting.•A dedicated cybersecurity team covering all critical cyber defense functions such as engineering, data protection, identity and access management, insider risk management, security operations, threat emulation and threat intelligence.•A training program that educates employees about cybersecurity risks and how to protect themselves from cyberattacks.•An awareness program that keeps employees informed about cybersecurity threats and how to stay safe online. •An incident response plan that outlines the steps the Company will take to respond to a cybersecurity incident, which is tested on a periodic basis.The Company engages reputable third-party assessors to conduct various independent risk assessments on a regular basis, including but not limited to maturity assessments and various testing. Following a defense-in-depth strategy, the Company leverages both in-house resources and third-party service providers to implement and maintain processes and controls to manage the identified risks.The Company’s Third-Party Risk Management program is designed to ensure that its vendors meet its cybersecurity requirements. This includes conducting periodic risk assessments of vendors, requiring vendors to implement appropriate cybersecurity controls and monitoring vendor compliance with the Company’s cybersecurity requirements.The Company’s cybersecurity risk management program and strategy are designed to ensure the company's information and information systems are appropriately protected from a variety of threats, both natural and man-made. Periodic risk assessments are performed to validate control requirements and ensure that the Company’s information is protected at a level commensurate with its sensitivity, value, and criticality. Preventative and detective security controls are employed on all media where information is stored, the systems that process it, and infrastructure components that facilitate its transmission to ensure the confidentiality, integrity, and availability of Company information. These controls include, but are not limited to access control, data encryption, data loss prevention, incident response, security monitoring, third party risk management, and