Company: UMBFO
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0000950170-25-028420
Chunk: 65

Company: UMB FINANCIAL CORP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1B
Chunk 65
---
There are no unresolved comments from the staff of the SEC required to be disclosed herein as of the date of this report.

ITEM 1C. CYBERSECURITYInformation security and privacy are an important part of the Company’s culture and foundational to its goal of delivering safe, secure and quality products and services. This philosophy is emphasized throughout the organization by its board of directors, senior leaders, officers, managers and associates to help promote a Company-wide culture of cybersecurity risk management. Further, the Company operates within the highly regulated financial services industry, which is focused on the security, confidentiality, integrity, availability and privacy of information and information systems. The standards of the SEC, the GLBA, the General Data Protection Regulation (GDPR), and the Federal Financial Institution Examination Council (FFIEC) outline specific requirements regarding cybersecurity and data privacy for publicly traded and financial services companies. The Company has established information security and privacy policies focused on protecting the security, confidentiality, integrity, availability and privacy of information, which policies are designed to be compliant with SEC, GLBA, GDPR, state privacy regulations and FFIEC guidance, as applicable, and incorporate principles from the National Institute of Standards and Technology (NIST) and other industry best-practices where appropriate. The Company’s security and privacy practices are also subject to ongoing independent oversight by multiple regulatory bodies including the OCC and the FRB, independent audits such as SOC I and SOC II, independent penetration testing of internal and external systems, independent security attestations of compliance with the requirements of the Society of Worldwide Interbank Financial Telecommunications (SWIFT) and the Federal Reserve (FedLine), and independent assessments in connection with the Company’s Payment Card Industry Data Security Standard (PCI DSS) obligations, as applicable.   As a financial institution, the Company collects, stores, and transmits sensitive, confidential, and proprietary data and other information, including intellectual property, business information, funds-transfer instructions, payment card data, and the personally identifiable information of its customers and employees (Sensitive Information). Sensitive Information can be of significant value to criminal actors, and, as described in the Company’s Risk Factors, cyber incidents and other security breaches involving this information at the Company, at the Company’s service providers or counterparties, or in the business community or markets, may negatively impact the Company’s business or performance.

31

The board of directors of the Company has oversight responsibility for the risk management policies of the Company’s global operations and the operation of the Company’s global risk management framework. The Board Risk Committee, comprised