Company: TFC
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0000092230-25-000020
Chunk: 115

Company: TRUIST FINANCIAL CORP
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 115
---
ITEM 1C. CYBERSECURITY

The following is a discussion of Truist’s cybersecurity risk management strategy and governance. Refer to the “Risk Management” section of Part II, Item 7 for additional discussion.Cybersecurity risk management and strategyLike other financial services firms, Truist faces an increasingly complex and evolving cybersecurity threat environment. See Item 1A, “Risk Factors” for information on risks from cybersecurity threats. We maintain a risk-based cybersecurity framework that is part of our ERM Framework. It is implemented through people, processes, and technology, whereby we assess, identify, and manage material risks from cybersecurity threats, and seek to adapt our risk mitigation activities accordingly.Foundationally, our cybersecurity framework is based upon the National Institute of Standards and Technology for Improving Critical Infrastructure Cybersecurity and is also designed to incorporate elements from additional industry standards, such as those of the Federal Financial Institutions Examination Council, to better suit the Company’s cyber risk profile. In addition, our cybersecurity framework incorporates internal and third-party capabilities that drive the development and implementation of our data security strategy, which is designed to reduce cybersecurity risk while enabling Truist’s corporate business objectives.Processes for assessing, identifying, and managing material risks from cybersecurity threatsWe maintain an Information Security Program that specifies how we execute our cybersecurity framework. The Information Security Program is designed to assess, identify, and manage risks arising from the cybersecurity threats facing Truist. Truist maintains cybersecurity and information security policies, procedures, and technologies that are intended to protect our clients’, teammates’ and our own data against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning.For example, to further mitigate the risks presented by an evolving cyber threat landscape, Truist:•provides data protection guidance to clients;•promotes data protection awareness and accountability through mandatory teammate training; and •conducts scenario-driven test exercises simulating impacts and consequences developed through analysis of real-world incidents as well as known and anticipated cyber threats. These exercises are designed to assess the viability of Truist’s crisis response and management programs and provide the basis for improvement. In addition, as a key part of the Company’s Information Security Program, Truist participates in the federally recognized Financial Services Information Sharing and Analysis Center, as well as other industry organizations and initiatives that promote industry best practices, such