Company: ASB
Filing Date: 2025-02-12
Form Type: 10-K
Source: 0000007789-25-000013
Chunk: 209

Company: ASSOCIATED BANC-CORP
Filing Date: 2025-02-12
Form: 10-K
Item: Item 1C
Chunk 209
---
 and red team exercises. The Corporation’s Incident Response Plan helps reduce the risks related to security incidents by providing guidelines on responding to incidents by focusing on a roadmap for coordinating personnel, policies, and procedures.•Third-Party Risk Management: Management of the Corporation’s third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by Corporate Risk Management. •Security Awareness and Education: The Corporation provides annual, mandatory training for personnel regarding security awareness as a means to equip the Corporation’s personnel with the understanding of how to properly use and protect the computing resources entrusted to them, and to communicate the Corporation’s information security policies, standards, processes and practices.

42

The Corporation leverages regular assessments to identify current and potential threats and vulnerabilities within the Corporation’s environment, using vulnerability scanning tools, penetration testing, system management tools, and process and procedural reviews.  The Corporation conducts a variety of assessments throughout the year, both internally and through third parties. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, Risk Factors — Operational Risks for additional disclosures with regard to the possible impact of future cybersecurity threats or incidents.GovernanceThe Board of Directors, through the ERC, provides direction and oversight of the enterprise-wide risk management framework of the Corporation, and cybersecurity represents a component of the Corporation's overall approach to enterprise-wide risk management. The ERC reviews and approves the Information Security Policy. The Board of Directors receives regular presentations which include updates on cybersecurity risks, including the threat environment, evolving standards, projects and initiatives, vulnerability assessments, third-party and independent reviews, technological trends and information security considerations arising with respect to the Corporation’s peers and third parties. The Board of Directors also receives information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the full Board of Directors discusses the Corporation’s approach to cybersecurity risk management with the Corporation’s CISO.The CISO, under the guidance of our CIO, CRO, Chief Executive Officer and General Counsel, works collaboratively across the Corporation to implement an information security program. To facilitate the success of the Corporation’s