Company: CMA
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000028412-25-000108
Chunk: 254

Company: COMERICA INC
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1
Chunk 254
---
 securities is not insured or guaranteed by the FDIC.

Investments in Comerica’s common or preferred stock are not deposits or other obligations of a bank or savings association and are not insured or guaranteed by the FDIC or any other governmental agency.

Item 1B.  Unresolved Staff Comments.

None.

Item 1C.  Cybersecurity.

Managing technology risks, including risks related to cybersecurity, is an integral part of Comerica’s enterprise risk management framework and processes. As such, Comerica uses a library of processes, risk and controls to assess, identify and manage cybersecurity risks. Comerica measures such risks in part by estimating the likelihood and potential impact of incidents. Comerica seeks to manage such risks by designing, documenting, and implementing controls, testing those controls through compliance assessments and internal and external audits and, in some cases, by transferring the risk in whole or in part through methods such as insurance. When an incident occurs, Comerica works to remediate the incident while complying with its regulatory obligations, and then evaluate the remediation for effectiveness. Comerica communicates on risk management matters through documented policies and procedures, management and Board committee reporting, and training and other employee communications.

For a description of how cybersecurity risks may materially affect Comerica’s business strategy or results, see "Item 1A. Risk Factors.” To date, there have been no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect Comerica's business strategy, financial condition or results of operations. 

Comerica engages information technology risk management employees with experience and expertise in cybersecurity. The organization consists of professionals in identity and access management, cyber defense operations, security engineering and information technology governance, risk and compliance. An Executive Vice President/ Chief Information Security Officer (with over 25 years’ experience in cybersecurity risk management) and a Chief Information Officer (with over 27 years’ experience in technology risk management) lead this team. Each reports directly to the Senior Executive Vice President / Chief Operating Officer, who reports directly to Comerica’s Chief Executive Officer and the Board of Directors. In addition, Comerica engages third parties from time to time to assess, manage and respond to cybersecurity risks through risk assessment, penetration testing, incident response, threat intelligence, education, and managed security services.

Comerica also oversees and identifies risks from threats to third parties, such as service providers, through efforts such as monitoring, risk assessments, audits