Company: CVBF
Filing Date: 2025-02-28
Form Type: 10-K
Source: 0000950170-25-029985
Chunk: 121

Company: CVB FINANCIAL CORP
Filing Date: 2025-02-28
Form: 10-K
Item: Item 1B
Chunk 121
---
 meet appropriate security requirements, controls and responsibilities and to investigate and report on security incidents that have impacted their operations, as appropriate.Education and AwarenessOur policies require each of our employees to participate in our data security efforts. We regularly remind employees of the importance of handling and protecting customer and employee data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats. We also conduct regular phishing email exercises and training to test employees of security practices to mitigate this threat. External AssessmentsOur cybersecurity policies, standards, processes and practices are periodically assessed by third parties and internal and external auditors. These assessments include a variety of activities including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. These assessments are reported to senior management and our Board through its Audit Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.  GovernanceBoard OversightOur Board, through its Audit Committee, oversees the management of our cybersecurity program led by our CISO. The Audit Committee receives regular reports from management about the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents, including material security risks and information security vulnerabilities.  Specifically, the Audit Committee receives regular updates from our CISO on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, and any relevant internal and industry cybersecurity incidents.Management’s ResponsibilityThe Bank's cybersecurity program is managed by our CISO, who reports to the Audit Committee. Management’s Corporate Information Security Committee (the “Security Committee”), led by our CISO, is a governance body that drives alignment on security decisions across multiple departments and functional areas within the Bank, while monitoring and managing Cyber risks to minimize exposure to the Bank. Members of the Security Committee include the Chief Information Officer (“CIO”), the CRO, and the COO.  The Security Committee oversees processes for assessing, identifying, and managing material risks from cybersecurity threats. The Security Committee meets at least quarterly to review cybersecurity performance metrics, identify cybersecurity risks, and assess the status of approved cybersecurity enhancements. The Security Committee also considers and makes recommendations on cybersecurity policies and procedures, service requirements, and risk mitigation strategies. 

33

Our CISO has more than 27 years of Information Technology and 21 years of Information Security experience in financial services including two other regional banks.  He holds an undergraduate and master’s degree in Cybersecurity and Information Assurance. Our CIO has 25 years of information technology experience and 18 years of experience in