Company: BOKF
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0000875357-25-000013
Chunk: 150

Company: BOK FINANCIAL CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 150
---
 our cyber defense posture, creating and retaining cyber-aware customers, considering identities at system access, and preparing a cyber-resilient workforce. Our cybersecurity team operates under eight distinct programs, each led by a subject matter expert. Each program has its own strategy, projects, and initiatives designed to achieve the overall strategic objective and its key components.The collective framework, regulatory compliance requirements, and associated controls are collectively referred to as the ISMS. The ISMS provides a comprehensive structure that supports the Information Security Program designed to safeguard information technology resources, maintain the confidentiality, integrity and availability of data, and manage the resources used to provide technology and security services to the organization.To date, no cybersecurity threats or incidents have materially affected, or are reasonably likely to affect, the Company including its business strategy, results of operations, or financial condition.

19

GovernanceThe Company’s cybersecurity program is overseen by the Risk Committee of the Board, which is responsible for ensuring the program is well resourced and able to protect the security and confidentiality of our data and that of our clients. The program is managed by the CISO who reports to the chief risk officer and is reviewed by regulators, as well as internal auditors. The CISO provides quarterly information security updates to the Risk Committee as well as the Company’s executive-level Risk Council on cybersecurity programs, policies and controls, efforts to improve security, and responses to cybersecurity events. Annually, the CISO meets with the Risk Committee of the Board of Directors to communicate the Board's responsibilities for cybersecurity and privacy, as well as the cybersecurity program’s strategy for addressing emerging risks and regulatory requirements.The Company’s CISO has over 28 years of experience building and operating enterprise security functions, security engineering, and security governance and program management. Prior to joining the Company, the CISO managed an Information Security and Risk Management program within a Fortune 500 energy company that handled a wide variety of information security issues including industrial control system security. The CISO has also served on the board of several academic institutions, professional service organizations, and local non-profits and contributed on many special committees for cybersecurity initiatives.