Company: RNST
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000715072-25-000054
Chunk: 72

Company: RENASANT CORP
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 72
---
ITEM 1C. CYBERSECURITY

Risk Management and StrategyGeneral. The Company’s information security program, including its processes with respect to cybersecurity, is focused on protecting our systems, networks and data from unauthorized access by a third party. Concerns about cybersecurity risks impact, at some level, every facet of the Company’s operations, from the way we structure the services we offer, to how we communicate with our customers, to our interactions with and training of employees, and to the expenditures we make when expanding and enhancing our technological infrastructure. We expect this continue to be the case as cybersecurity threats, and the means to respond to those threats, continue to evolve.The Company has adopted a defense-in-depth philosophy that relies on multiple systems and processes to reasonably provide for the confidentiality, integrity and availability of our systems, networks and data. Features of our information security include:•Documentation: We have written policies and procedures that delineate the roles and responsibilities of the Company’s Board of Directors, executive management and other employees, as well as outside parties, with respect to the various aspects of the information security program. This documentation helps to align the entire information security program with our efforts to maintain the integrity of the Company’s cybersecurity. These policies and procedures are reviewed and updated at least annually.•Separation of duties: Separation of duties means that, where appropriate, a task is designed to ensure that more than one person or group is responsible for its completion. We believe that separation of duties helps to prevent fraud, misuse or other security compromise, and we apply this concept when we delegate administrative and oversight responsibilities to multiple groups for certain aspects of the information security program, including identity and access management, network management, system administration, policy oversight, monitoring and alerting.•The principle of least privilege: Access approval for the Company’s employees is coordinated between an employee’s manager, the Company’s human resources department and the information systems administrator. The goal is to give an employee access rights to our data, applications and other information resources only to the extent necessary for the employee to perform the functions of the particular job. Any change in employment responsibilities that requires access changes is implemented using the same access approval procedures. Finally, all remote access into the Company’s networks must be approved by the Chief Information Security Officer (which we refer to as the “CISO”).•Vulnerability and patch management: The Company’s vulnerability management program includes internal and external scanning using third-party tools and services. Software patches are deployed based on criticality of vulnerability. Further, we track our performance in