Company: BOKF
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0000875357-25-000013
Chunk: 149

Company: BOK FINANCIAL CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 149
---
ITEM 1C.   CYBERSECURITY

Risk Management and StrategyBOK Financial is committed to safeguarding company and client information through protections integrated into all lines of business, support functions, and third-party relationships. To effectively manage cybersecurity risks mentioned in Item 1A, our cybersecurity risk management program evaluates the likelihood and potential damage of internal and external threats. We also evaluate the adequacy of our policies, procedures, and capabilities in place to mitigate cyber risk at least annually.Each employee and contractor is responsible for the security and confidentiality of company and client information. This expectation is communicated at onboarding and through required annual data security and privacy trainings; frequent internal publications; and annual employee attestations to the Company’s Standards of Conduct. BOK Financial regularly conducts risk assessments to evaluate internal controls implemented to prevent and detect data breaches. These controls are aligned with ISO 27001:2013 and the NIST Cybersecurity Framework Version 2.0 and are frequently monitored to ensure their effectiveness. The controls are routinely tested via tabletop exercises and reviewed by internal auditors.Vulnerability and penetration assessments are also conducted at least annually by an independent third party. In addition to a strong set of internal controls, the Company has implemented a robust due diligence process for third-party providers prior to executing an agreement. Risk assessments include evaluating the third party’s security posture through intelligence feeds, SOC reports, ISO certifications, and self-attestation questionnaires. Third parties processing customer data are contractually required to meet all legal obligations for protecting against anticipated security threats to client data, protecting against unauthorized access to client data, and ensuring proper disposal of client data. An array of protective technologies have been implemented to detect and respond to indicators of malicious behavior before an incident ever takes place; however, should a cybersecurity incident occur, the Company has incident response and recovery procedures, which include determination of materiality and proper notification and reporting to the appropriate parties. These include legal and regulatory reporting requirements as well as notifications to impacted customers. The Company collaborates with peer financial institutions, local universities, threat intelligence organizations, third-party providers, law enforcement, and our customers to share tactical threat intelligence and best practices in protecting against emerging threats.Results of cybersecurity risk assessments and tabletop exercises are reported to governance committees and aid in the development of our cybersecurity strategy, which takes into account the Company's strategic objectives and our ability to navigate potential internal and external disruptions. The overarching objective of our cybersecurity strategy is to reduce risk and enhance the resilience of our assets. Four key components support this objective: enabling