Company: TFC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000092230-25-000020
Chunk: 116

Company: TRUIST FINANCIAL CORP
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 116
---
 as harmonized cybersecurity standards, cyber readiness, and secure consumer financial data sharing.Our Cyber Incident Response Team is responsible for identifying, triaging, and containing cybersecurity threats and incidents, including, to the extent possible, those experienced by third-party service providers. Incidents with potential for higher impacts are routed to an enterprise response function that coordinates the response activities across impacted resource groups and business stakeholders. Through this structure, Truist manages its cyber, business, and legal obligations, including escalation to executive management and the Board, as appropriate, client and regulatory notifications, and remediation activities.Our Information Security Program is also designed to help oversee, identify, and mitigate cybersecurity risks associated with our use of third-party service providers. Following an initial assessment of the level of enterprise risk potentially posed by use of the third party, the service provider is then subject to further risk-based assessments on its operational resilience and cybersecurity practices, including disaster recovery and business continuity plans that specify the time frame to resume activities and recover data. In its agreements with third-party service providers, Truist requires service providers to adhere to Truist’s relevant cybersecurity and operational resilience standards, subject to certain exceptions that are managed on a case-by-case basis.Our Information Security Program is assessed periodically to test the effectiveness of key controls through cybersecurity maturity measurements, technology risk oversight, compliance risk management testing and monitoring, internal audit review, and regulatory oversight.In addition, Truist maintains disaster recovery plans that are reviewed, modified, and approved annually.

Truist Financial Corporation   41

Management’s role in assessing and managing material risks from cybersecurity threatsTruist’s Information Security Program is operated and maintained by management, including the CIO, interim CISO, and CRO. These senior officers are responsible for assessing and managing Truist’s cybersecurity risks. Our Information Security Program also includes processes for escalating and considering the materiality of incidents that impact Truist, including escalation to executive management and the Board, which are periodically tested through tabletop exercises to assess Truist’s preparedness. Our cybersecurity framework strategy, which is overseen by the interim CISO, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing.In addition, various management committees assess and manage Truist’s cybersecurity risks. These committees promote visibility and awareness of cybersecurity risks and drive action and escalation as needed. The primary management committees involved in Truist’s Information Security Program are the Enterprise Technology Risk Committee and the Technology Risk Oversight Committee, each of which is a