Company: CVBF
Filing Date: 2025-04-08
Form Type: DEF 14A
Source: 0000950170-25-051966
Chunk: 14

Company: CVB FINANCIAL CORP
Filing Date: 2025-04-08
Form: DEF 14A
Chunk 14
---
 including gender, race, ethnicity, religion or national origin. All marketing campaigns and materials are overseen by our Marketing Department and, where applicable, are reviewed by our Risk Management Department and our internal legal counsel.

Data Security

We are committed to protecting our customers’ and associates’ personal and financial information, and we believe our Board of Directors and executive management team devote a significant amount of time to monitoring and managing information security and cybersecurity risks, since cybersecurity incidents compromising non-public personal financial information ("NPPI") could produce material adverse effects on the Company’s business, including but not limited to, loss of customers, reputational harm, loss of intellectual property, disruption of key business operations, governmental fines/penalties, and litigation/remediation liability and costs.

#### page9
Under the direction of our Chief Information Security Officer ("CISO"), Citizens Business Bank maintains a formal information security management program to address known cybersecurity risks. This program leverages industry frameworks and standards with the goal of ensuring appropriate controls are established and regularly assessed for adequacy. Major components of the program include safeguarding customer and associate information, third party vendor oversight, incident response and seeking to ensure business continuity.

Our Board Audit Committee receives regular reports and briefings from our CISO, at least once per quarter or more frequently as circumstances may require, on cybersecurity issues, including on the Company’s risk posture to protect against cybersecurity threats, and on policies that are intended to adequately implement the Company’s information security management program. The CISO and our CRO also periodically inform our Board of Directors about efforts relating to compliance, examinations, risk assessments, results of audits, penetration and vulnerability testing, security breaches or violations, and recommended changes to our information security management program. This periodic reporting includes an annual review of regulatory requirements relating to cybersecurity, the federal Gramm-Leach Bliley Act, the California Consumer Privacy Act and the California Privacy Rights Act.

The Company maintains a cybersecurity insurance program covering a range of potential scenarios and contingent risks through Resilience Cyber Insurance Solutions (“Resilience”), and the Company’s cybersecurity program has been externally evaluated within the past year by Resilience as well as the Company’s cybersecurity insurance broker, Aon Commercial Risk Solutions. Moreover, starting in 2022, Citizens Business Bank has retained Resilience to assist us in conducting an annual simulation of a major cybersecurity event to test our organization’s readiness capabilities. In addition, Citizens Business Bank’s prudential bank regulators conduct annual cybersecurity and privacy audits. The Company also provides regular training for all associates on information