Company: MTB-PJ
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0001628280-25-006267
Chunk: 83

Company: M&T BANK CORP
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 83
---
Item 1C.     Cybersecurity.

The Company has established polices, processes, controls and systems designed to identify, assess, measure, manage, monitor and report risks related to cybersecurity and help prevent or limit the impacts of potential cyber threats and attacks. As cyber threats continue to evolve, the Company expects to continue to expend significant resources to adapt to changes in the threat environment and enhance its measures to detect and prevent cyber attacks or to investigate and remediate known information security vulnerabilities and incidents. The risks faced by the Company from cyber threats that could materially affect the Company, including its business strategy, results of operations or financial condition, are discussed in Part I, Item 1A, "Risk Factors" within this Form 10-K.

Cybersecurity is integrated into the Company’s Risk Framework through which the Company identifies, assesses, monitors, controls, communicates and escalates risks. The Risk Framework, which is reviewed and approved by the Risk Committee of the Board of Directors at least annually, represents the Company’s overall risk management approach, including the policies, processes, controls and systems, through which the Company seeks to manage risk, including cybersecurity risk. It aims to provide a common foundation for all employees and officers as well as directors to help understand and communicate the types of risks that the Company faces in pursuit of its business objectives. The Risk Framework includes oversight by management through a multi-tiered committee structure responsible for overseeing proactive risk identification, developing an aggregated view of 

45

risks, and providing a consistent governance methodology across the Company. All such committees, including a management committee which has primary authority for oversight of cybersecurity, report up to the Management Risk Committee, which is chaired by the Chief Risk Officer, and serves as the executive level committee responsible for the implementation and oversight of the Risk Framework. The Risk Framework is designed to ensure the Board of Directors and its Risk Committee, which is the primary Board committee that oversees cybersecurity, are provided the information necessary to be effective in its risk management oversight responsibilities.The Risk Committee of the Board of Directors, including a subcommittee of the Risk Committee, provides oversight of cybersecurity risks and receives regular reports on cybersecurity from the CISO. The CISO is responsible for the design and execution of the Company's Information Security Program, which is supported by the governance structure defined within the Risk Framework. The CISO reports as necessary to executive management, the Risk Committee of the Board and the Board of Directors on cyber and information security issues and the effectiveness of the Company’s cyber and Information Security Program. The