Company: WAL-PA
Filing Date: 2025-02-25
Form Type: 10-K
Source: 0001212545-25-000090
Chunk: 75

Company: WESTERN ALLIANCE BANCORPORATION
Filing Date: 2025-02-25
Form: 10-K
Item: Item 1C
Chunk 75
---
 information technology organizations collaborate with the CISO organization as described herein, to create independence between the CISO and CIO functions, the CISO reports to the Company’s Chief Administration Officer and the CIO reports to the Company’s Chief Banking Officer for National Business Lines. Each Company employee is responsible for an effective cybersecurity defense which is enforced with mandatory interactive cyber awareness training, periodic newsletters, executive security briefs and updates. Additionally, the BOD’s Risk Committee is informed about cybersecurity and the relevant risks posed to the Company via regular updates from the Company’s CISO and CIO. The BOD is regularly informed and actively oversees the data security and privacy program and its policies. The BOD also receives regular education on innovative technology, cybersecurity, information systems/data management, fintech and privacy, from internal and external experts.Cybersecurity assessmentThe Company engages external third parties to perform assessments on our adherence to the FFIEC’s recommendations on cyber preparedness and NIST Cybersecurity Framework, as well as to review for best practices for the use of cloud services, Swift and FedLine requirements. To validate the effectiveness of the Company’s overall information security controls, external third parties also perform full-scope external and internal penetration testing designed to mimic the tactics used by individual hackers or criminal hacking organizations. The Company also engages external third parties to perform ongoing adversarial simulation.The Company conducts regular internal cybersecurity assessments intended to measure inherent risk and drive the adjustment of our security posture according to the latest threats. These assessments include alignment with the FFIEC’s recommendations on cyber preparedness, GLBA Safeguards Rule to protect user data, and Swift security control requirements. The Company performs continuous internal and external vulnerability scanning to measure and react to new vulnerabilities and seeks conformance to Center for Internet Security benchmarks for both cloud-based and on-premises technology. The Company reviews vendor and partner security practices to ensure they maintain proper information security safeguards.Cybersecurity operational measuresOperationally, the Company’s overall cyber risk strategy is a collaborative process between the CIO and the information technology teams, and the CISO led data protection, information and cyber teams. The CIO oversees the establishment and 

30

Table of Contents

implementation of the technical plan for cyber risk strategy which the CISO and his team reviews and critiques. After they have established a joint cyber risk plan, the Company’s second line of defense reviews and challenges the plan. Thereafter, the CISO and CIO teams cooperate with subject-matter experts throughout the business to identify, monitor and mitigate material risks,