Company: FRME
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000712534-25-000058
Chunk: 182

Company: FIRST MERCHANTS CORP
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 182
---
 harmful actions across our information technology environment.  Policies over information security are Board-approved and various types of control testing is conducted throughout the year, both by internal and external parties.  Findings are actioned on throughout the year and reported to various committees.  The Corporation has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework for the management and development of cybersecurity controls and is an active participant in the financial sector information sharing organization structure, known as the Financial Services Information Sharing and Analysis Center.The Corporation’s Chief Information Security Officer (CISO) is responsible for assessing and managing the Corporation’s risks from cybersecurity threats.  The CISO is an active Certified Information Security Systems Professional and has been with the organization for 18 years with over 21 years of experience in technology infrastructure and security.The Information Security Department conducts cyber incident tabletop exercises on an ongoing basis.  These exercises vary by topic, but may include internal incident response teams, executive management, and third parties that provide services across forensic, legal, and public relations capabilities.  The purpose of these tabletops is to simulate a cyber event and work through the event using our Incident Response Plan. This allows our incident response team to become familiar with the logistics of the plan, as well as provide feedback to improve the process and plan.  External subject matter experts, such as Bank legal counsel, forensic advisors, marketing agency and insurance broker participate in these exercises.  Management has established an Information Security Committee in order to assist executive management and the Board of Directors of the Bank in fulfilling their oversight responsibilities related to information security. The Corporation’s Information Security Committee consists of members with diverse experience, including the Corporation’s leaders from information security, enterprise risk management, legal, bank protection, internal audit and various business units. The Corporation’s information security professionals have a range of varying cybersecurity experience and education, many of whom have substantial experience assessing and managing cybersecurity initiatives and hold certain cybersecurity certificates. The Corporation uses multiple assessors, consultants, auditors and other third parties in the fulfillment of the information security program.  These third parties participate in testing and validation processes, as well as the execution of certain program-related controls.  The Committee reports its activities, key conclusions and recommendations to the Enterprise Risk Management Committee and the Board’s Risk and Credit Policy Committee of the Board on a quarterly basis.  At the Information Security Committee, security-related policies and standards are reviewed and recommended for approval, annual risk assessment results and action plans are noted, annual penetration test reports shared, current security incidents discussed, and relevant cyber