Company: HBAN
Filing Date: 2025-02-14
Form Type: 10-K
Source: 0000049196-25-000020
Chunk: 164

Company: HUNTINGTON BANCSHARES INC /MD/
Filing Date: 2025-02-14
Form: 10-K
Item: Item 1C
Chunk 164
---
Item 1C: Cybersecurity

Cybersecurity represents an important component of Huntington’s overall cross-functional approach to risk management. Our cybersecurity practices are integrated into Huntington’s ERM approach, and cybersecurity risks are among the core enterprise risks identified for oversight by our Board through our annual ERM assessment. See “Risk Factors—Operational Risks” for information on risks from cybersecurity threats. Our cybersecurity policies and practices are designed to follow the cybersecurity framework of the National Institute of Standards and Technology and other applicable industry standards. Consistent with Huntington’s overall ERM policies and practices, our cybersecurity program includes:•Vigilance: We maintain a global cybersecurity threat operation designed to detect, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing disruptions, compromises, and failures to our business.•Collaboration: We have established collaboration mechanisms with public and private entities, including intelligence and enforcement agencies, industry groups, and third-party service providers to identify and assess cybersecurity risks.•Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls, and ongoing vulnerability assessments.•Third-Party Management: We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, such as vendors, service providers, and other users of our systems.•Education: We provide periodic and ongoing training for personnel regarding cybersecurity threats, with such training scaled to reflect the roles, responsibilities, and access of relevant personnel.•Incident Response Planning: We have established and maintain incident response plans that are designed to address our response to a cybersecurity incident, and such plans are tested at least annually, or more frequently as needed.•Communication and Coordination: We utilize a cross-functional approach to evaluating the risk from cybersecurity threats and incidents, involving management personnel from our technology, operations, legal, risk management, internal audit, and other key business functions, as well as members of our Board and the Technology Committee of the Board (the “Technology Committee”).•Governance: The Board’s oversight of cybersecurity risk management is supported by the Technology Committee, which has responsibility for the development, implementation, maintenance, and risk management of the cybersecurity program and regularly interacts with Huntington’s ERM function, individual members of management, and relevant management committees.

A key part of Huntington’s strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, and other exercises