Company: KEY-PI
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000091576-25-000038
Chunk: 198

Company: KEYCORP /NEW/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 198
---
ITEM 1C. CYBERSECURITY

Cybersecurity Risk Management

As a financial services institution, Key faces heightened risk of cybersecurity incidents. Risks and exposures relatedto cybersecurity incidents are expected to remain high for the foreseeable future due to the rapidly evolving natureand sophistication of cybersecurity threats and geopolitical events, as well as due to the expanding use of Internet and mobile banking and other technology-based products and services utilized by us and our clients, including products and services that utilize the cloud and artificial intelligence (AI), among other emerging technologies. To date, Key has not experienced material disruption to our operations, or material harm to our client base, from cyberattacks. However, we have incurred, and may again incur, expenses related to the investigation of cybersecurity incidents involving third-party providers or related to the protection of our clients from identity theft as a result of such incidents. We have also incurred, and may continue to incur, expenses to enhance our systems or processes to protect against cyber or other security incidents. For more information, see “Risk Factors—We and third parties on which we rely (including their downstream service providers) may experience a cyberattack, technology failure, information system or security breach or interruption” in Item 1A. Risk Factors of this report.Key maintains an Information Security Program (the “IS Program”) to support the management of information security risk, including cybersecurity risk, across the organization. The IS Program is designed to protect Key’sclients, employees, third parties, and assets from threats by managing the confidentiality, availability, and integrity ofKey’s information assets. Our Chief Information Security Officer (“CISO”), who is also the Enterprise SecurityExecutive, oversees the IS Program and its related policy and has overall responsibility for managing the appropriate identification and ownership of cybersecurity risks. Key’s Corporate Information Security Team, under the oversight of the CISO, is responsible for maintaining the IS Program, assessing program-level risks and threats to our information assets, and overseeing the proper level of investment in security resources.The IS Program is designed to provide safeguards for Key’s assets through a series of administrative, technical,and physical controls. Key employs a variety of security practices and controls to protect information and assets,including, but not limited to, access controls, vulnerability scans, network monitoring, internal and externalpenetration testing, monitoring of vendor vulnerability notices and patch releases, scanning of systems and emailsfor malware and other vulnerabilities, firewalls and intrusion detection and prevention systems, and dedicatedsecurity personnel.As described in more detail in “Risk Management — Overview” in Item 7 of