Company: WAL-PA
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001212545-25-000090
Chunk: 74

Company: WESTERN ALLIANCE BANCORPORATION
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 74
---
29

Table of Contents

Item 1C.    Cybersecurity.

Cybersecurity risk management and strategy

Cybersecurity and risks associated with information security are operational risks included in the Company’s ERM Framework. Cybersecurity risks may also include fraud, harm to employees or customers, violation of privacy or security laws and other legal risks, and reputational risk. These risks are all considered in the Company’s ERM Framework as part of the Company’s overall risk assessment process. Under the ERM Framework, the Company’s Information Security Risk and Compliance departments and all employees are the First Line. Those in the First Line are each responsible for identifying and managing the information security risk associated with their activities. The Company’s Enterprise & Operational Risk Management Department is part of the independent risk oversight of information security risk along with the Company’s ORMC and ERM Committee, both of which are management risk oversight committees. The Company manages the risk associated with cybersecurity and information security in accordance with our Risk Appetite Statement, as approved by the BOD.The Risk Committee of the BOD and ERM Committee are primarily responsible for monitoring management’s implementation of operations and technology risk controls, including those relating to cybersecurity and information security. The Audit Committee of the BOD oversees the audit control functions of which cybersecurity practices may be a part. The Company maintains a data protection and information security program designed to ensure adequate governance and oversight is in place while evolving to meet changes in applicable laws and regulations, and best practices. The Company’s information security controls and programs are designed to align with the NIST for cybersecurity, the FFIEC examination guidelines, Control Objectives for Information and Related Technologies and the Information Technology Infrastructure Library frameworks, along with applicable privacy laws.Information Security is the responsibility of the officers, employees and agents of the Company with oversight by the BOD. Our investment in people is critical to maintaining an effective cyber defense, which begins by developing and maintaining a robust Information Security function within the First Line. Collectively, the Company’s senior leadership in this area have over 75 years of experience. The Company’s CISO has over 25 years of network architecture, information technology and cybersecurity experience, maintains Certified Information Systems Security Professional credentials and has served on the Federal Reserve Secure Payments Task Force. The Company’s CIO has over 30 years of technology executive leadership, technology experience focused on strategy, design, development, implementation and support of application systems, and overseeing transformative technology changes, including digital transformations and fraud and BSA/AML capabilities. While the CIO and