Company: CFG-PE
Filing Date: 2025-02-13
Form Type: 10-K
Source: 0000759944-25-000013
Chunk: 595

Company: CITIZENS FINANCIAL GROUP INC/RI
Filing Date: 2025-02-13
Form: 10-K
Item: Item 1C
Chunk 595
---
ITEM 1C. CYBERSECURITY

Risk Management and Strategy

The Company’s Cybersecurity Program (“CSP”) drives an end-to-end, continuous process that protects our customers, colleagues, assets, premises, systems, and information (electronic and non-electronic), and is designed to ensure compliance with current and emerging federal and state laws and regulations. The CSP is designed to ensure the effective implementation of the Corporate Security and Resilience Operating Model across all business lines of the Company and is under the supervision of the Chief Security Officer (“CSO”).Operational Risk Management coordinates the development, maintenance, and day-to-day oversight of the Company’s Enterprise Risk Management Governance Framework (“the Framework”), which defines an integrated enterprise-wide approach to risk management. This centrally managed program is designed to ensure that all business lines play a role in the successful implementation of the CSP. The CSP aligns with the Framework, enabling the CSO to provide risk oversight to and drive accountability from the business lines.The CSP is designed to assess and mitigate threats and risks to the Company. New and emerging threats are assessed through an intelligence lifecycle, which includes threat modeling. In addition, risk assessment processes drive risk identification and measurement related to security. Once risks are identified and measured, the Framework is leveraged to track and mitigate them. Control testing is utilized to demonstrate that risks are managed effectively, identify gaps in expected control operation, and develop appropriate remediation plans, in order to manage risk to the Company within tolerable limits.As part of the Company’s Third Party Risk Management Program and in support of the CSP, reviews for cybersecurity, business continuity, fraud, and other policy-related topics are performed for the onboarding of new vendors and ongoing monitoring of existing vendors. Ratings assigned to a vendor determine review frequency and scope. Results are reported to key stakeholders and identified issues are tracked and monitored.

Citizens Financial Group, Inc. | 34

The Company regularly reviews the nature of its business activities and modifies the CSP as appropriate. Many of the elements of the CSP are cyber defense related and are in place to reduce our risk to a wide range of potential cyber threats that may target our assets and information daily. The effectiveness of the CSP is assessed and measured periodically by various lines of defense within the Company and is conducted primarily through risk assessments, assurance testing, and an independent audit. External organizations are also routinely engaged to assess our CSP and test our perimeter defenses. The effectiveness of the CSP is reported periodically to the appropriate governance committees.

Governance

Under the guidance of our CSO