Company: BOH
Filing Date: 2025-03-04
Form Type: 10-K
Source: 0000950170-25-031193
Chunk: 44

Company: BANK OF HAWAII CORP
Filing Date: 2025-03-04
Form: 10-K
Item: Item 1B
Chunk 44
---
 and consumers. In the event of an incident, we follow the detailed incident response plan, which outlines the steps to be followed from incident identification to mitigation, recovery and notification, including notifying functional areas, regulators, as well as senior leadership and the Board, as appropriate. All of our employees also have a responsibility to protect the privacy of bank confidential and proprietary information. They are required to undergo periodic information security awareness training to ensure a clear understanding of their roles in protecting information assets and to create a security-minded culture. We continue to strengthen the management and oversight of cybersecurity risks through new security system enhancements, policies, testing, identification and reporting. We also engage a third-party to perform penetration testing and ongoing analysis to identify potential vulnerabilities and areas for additional enhancements. We depend on third-party service providers to support our business and operational activities and to help us achieve our strategic goals. However, these third parties can introduce various risks to us and our customers. To mitigate these risks, we have established a Third Party Risk Management framework. This framework equips us with the necessary tools and practices for effective oversight of third-party service providers, ensuring compliance with legal and regulatory obligations, contractual requirements, performance expectations, and our own principles and values. Our vendor risk management practices are robust and include comprehensive risk assessments of suppliers, with a strong emphasis on cybersecurity. We use commercially available services to monitor our vendors, providing security scores for supplier technology services, threat intelligence, financial intelligence, and other cybersecurity-related considerations. Regular reviews are conducted to track changes in our vendors' cybersecurity risk posture, and continuous threat intelligence monitoring helps identify potential cybersecurity incidents involving third parties. We also strive to negotiate appropriate cybersecurity provisions in our vendor contracts. For the 2024 period, we reported no material cybersecurity incidents affecting the confidentiality, integrity, or availability of data or systems. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For further information, see Item 1A. “Risk Factors,” including the risk factor titled “An interruption or breach in security of our information systems or those related to merchants and third-party vendors, including as a result of cyber attacks, could disrupt our business, result in the disclosure or