Company: RNST
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000715072-25-000054
Chunk: 76

Company: RENASANT CORP
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 76
---
 security infrastructure is adequate to reasonably protect the Company’s systems and confidential and proprietary information from unauthorized access, and there are no suitable solution to address the information security team’s concerns, then we will not engage such vendor.The vendors we retain are also categorized by the level of risk that the vendor presents to us, of which information security risk is a component. The information security team annually reviews those vendors in the “high risk” category and periodically reviews other vendors. This review includes obtaining updated information security audits and service organization reports, where available, and otherwise analyzing whether the vendor’s cybersecurity risk profile has materially changed.The information security team’s review process does not, and cannot, guarantee that a Company vendor will not suffer a cybersecurity incident that impacts us.  Due to the possibility that a vendor’s information security may be breached, we also negotiate provisions in vendor contracts that address cybersecurity incidents. In addition to including provisions that address the parties’ relative responsibility for damages resulting from a cybersecurity incident at a vendor, these contracts also typically include provisions to ensure that the Company receives timely and complete notification of a cybersecurity incident and cooperation in responding thereto so that we can assess the extent of the incident’s impact on the Company’s systems or information, mitigate any adverse effects arising therefrom and comply with any customer or regulation notification requirements and other legal, regulator or contractual obligations.Incident Response.  For those situations where a cybersecurity threat or incident arises, whether internal to the Company or relating to one of its vendors, we have also organized an incident response team. The incident response team includes representatives from the information technology, operations, risk management, legal (including securities law counsel), privacy and finance departments, among others. In addition to meeting quarterly, the incident response team (or a subset of the team) gathers whenever there is a threatened or actual breach of the Company’s information security (whether involving an external actor or an internal party) to determine the nature and extent of the threatened or actual breach and, if appropriate, the steps to take in response thereto to protect the Company’s information security and mitigate any harm that has already occurred. The team is also responsible for ensuring the Company complies with legal and regulatory requirements (including notifying affected customers and regulators and making any filings required by the securities laws). The activities of our incident response team are reported to the Board’s Enterprise Risk Management Committee.The Company also maintains a cyber insurance policy that provides cyber liability coverage.Employee Training and Security Awareness. All employees are required to complete an annual security awareness training program. Courses within the training program include general