Company: UVSP
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000102212-25-000006
Chunk: 139

Company: UNIVEST FINANCIAL Corp
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1B
Chunk 139
---
, business continuity/ disaster recovery testing, and incident response plan testing. The CISO is a member of various management committees, chairs the Corporation's management-level Information Security Steering Committee, and presents information security and cybersecurity updates on a quarterly basis to the Corporation's Enterprise-Wide Risk Management Committee, which consists of members of management, including the Chairman, President and Chief Executive Officer of the Corporation, as well independent members of the Board of Directors.

The Enterprise-Wide Risk Management Committee provides oversight, from a risk perspective, of information systems security. 

Additional information security training to employees is provided through a management Information Security Steering Committee and also through targeted training overseen by the CISO. In addition, as discussed below, the Corporation has implemented an Incident Response Plan to provide a structured and systematic incident response process for information security incidents that affect any of the information technology systems, network, or data of the Corporation. The Incident Response Plan is implemented and maintained by the CISO and is subject to annual review and approval by the Enterprise-Wide Risk Management Committee. Cybersecurity metrics are reported to both management level committees and the Enterprise-Wide Risk Management Committee on a quarterly basis.

The Board of Directors recognizes the importance of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information and has incorporated those elements in its ongoing oversight of the Information Security Program.  

Risk Assessment. On a periodic basis, but not less than annually, the CISO, in conjunction with the Enterprise-Wide Risk Management Committee, identifies and documents internal and external vulnerabilities that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer records. Based on the results of the risk assessment, the Corporation's Information Security Program may be revised to protect against any anticipated threats or hazards to the security or integrity of such information. The Enterprise-Wide Risk Management Committee reviews changes to the program designed to monitor, measure, and respond to vulnerabilities identified.

Response to Security Vulnerabilities. In response to identified risks, management may take certain steps to correct and respond to security vulnerabilities, which may include:

a.Eliminating unwarranted risks by applying vendor-provided software fixes, commonly called patches.

b.Ensuring that changes to security configurations are documented, approved, and tested.

c.Ensuring that exploitable files and services are assessed and removed or disabled based upon known vulnerabilities and business needs.

d.Updating vulnerability scanning and intrusion detection tools to identify known vulnerabilities and related unauthorized activities.

e.Conducting subsequent penetration testing and vulnerability assessments, as warranted.

f.Reviewing performance