Company: HBAN
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000049196-25-000020
Chunk: 165

Company: HUNTINGTON BANCSHARES INC /MD/
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 165
---
 focused on evaluating effectiveness. We regularly engage third parties to perform assessments on our cybersecurity measures, including cybersecurity maturity assessments, and independent reviews of our cybersecurity control environment and operating effectiveness. The results of such assessments and reviews are reported to the Technology Committee and the Board when appropriate, and we adjust our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.

2024 Form 10-K     43

Table of Contents

The Technology Committee oversees the management of risks from cybersecurity threats, including the policies, processes and practices that management implements to address risks from cybersecurity threats. The Board and the Technology Committee each receive regular presentations and reports on cybersecurity risks which address a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and cybersecurity considerations arising with respect to peers and vendors. The Board and the Technology Committee are notified by the CEO regarding the occurrence of any potentially material cybersecurity incidents, including ongoing updates, when applicable. To keep the Technology Committee apprised of the continually shifting landscape, the Chief Information Security Officer provides updates to the Technology Committee on cybersecurity matters on at least a quarterly basis, and more frequently as necessary. The entire Board also participates in periodic cyber-related tabletop exercises.

Huntington’s Chief Information Security Officer is a member of our Technology Risk Committee, a management-level committee that is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across Huntington. The Chief Information Security Officer also works with members of the ELT, which includes our Chief Executive Officer, Chief Financial Officer, Chief Risk Officer, and General Counsel. The Chief Information Security Officer works collaboratively across Huntington to implement a program designed to identify and protect our information systems from cybersecurity threats and to promptly detect and respond to cybersecurity incidents. To facilitate this program, multi-disciplinary teams throughout Huntington are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with Huntington’s incident response plan. Through ongoing communications with these multi-disciplinary teams and across Huntington, the Chief Information Security Officer regularly monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents on an ongoing basis, and reports such threats and incidents to the CEO, who then reports to the Technology Committee and the Board when appropriate, as discussed above.

We believe our Board and management, including the Chief Information Security Officer, have the appropriate expertise, background, and depth of experience to manage risks arising from cybersecurity threats, including applicable knowledge gained through industry experience, academia