Company: NWBI
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001471265-25-000016
Chunk: 68

Company: Northwest Bancshares, Inc.
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1B
Chunk 68
---
.We also employ a variety of preventative and monitoring tools designed to monitor, block, and provide alerts regarding suspicious  activity including suspected. We have established processes and systems designed to mitigate cybersecurity risk, including regular and ongoing education and training for employees, preparedness simulations and tabletop exercises, and recovery and resilience tests. We engage in regular assessments of our infrastructure, software systems, and network architecture, using internal cybersecurity experts and third-party specialists. We also actively monitor our email gateways for incoming and outgoing malicious emails  and monitor remote connections as a significant portion of our workforce has the option to work remotely.The Company relies on third-party vendor solutions to support its operations. Many of these their-party vendors, especially in the financial services industry, have access to confidential, personal, sensitive and proprietary information. To mitigate the cyber, privacy and other operational risks associated with the use of third-party vendors, the Company maintains a third-party risk management program, which is implemented through a third-party risk management policy and includes a detailed onboarding process and periodic reviews of third-party vendors with access to confidential, personal, sensitive and propriety information. The third-party risk management policy applies to any business arrangement between the Company and another individual or entity, by contract or otherwise, in alignment with the Interagency Guidance on Third-Party Relationships: Risk Management. The third-party risk management program is audited periodically in accordance with our Board approved internal audit plan.We leverage internal and third-party auditors and independent third-party sources to periodically review our processes, systems, and controls related to our cybersecurity security program. This includes assessing control design and operating effectiveness and recommendations to strengthen our cybersecurity program. Regular internal monitoring is integral to the Company’s risk assessment process, which includes regular testing of internal key controls, systems, and procedures. In addition, independent third-party penetration testing of the effectiveness of security controls and preparedness measures is conducted at least annually or more often, if warranted by the risk assessment or other external factors. Management determines the scope and objectives of the penetration analysis.We maintain both an incident response plan and a crisis management plan (the “Plans”) that provide a documented framework for responding to actual or potential system failures, interruptions, or cybersecurity breaches, including timely notification of and escalation to the appropriate Board-approved management committees as discussed further below. The Plans are coordinated through the Business Resiliency Manager and Major Incident Manager, who ultimately report to the CISO and the CIO respectively, and key 

35

Table of Contents

members of management who are embedded into the Plans by their design. The Plans