Company: SFNC
Filing Date: 2025-02-27
Form Type: 10-K
Source: 0001628280-25-008639
Chunk: 79

Company: SIMMONS FIRST NATIONAL CORP
Filing Date: 2025-02-27
Form: 10-K
Item: Item 1C
Chunk 79
---
 to cyber risks, to the IT Committee. Significant security incidents are also reported by senior management to the IT Committee or its chairman, when warranted. The IT Committee chairman provides reports of the committee’s activities to the board of directors of Simmons Bank. The Company’s board of directors, or the board of directors of Simmons Bank (as applicable), also approves information security-related policies, including the Acceptable Use Policy, Information Security Policy, IT Ransomware Policy, and Business Continuity Management Policy.With respect to internal management, the CISO and CIO meet regularly to discuss the activities and operations of the information security team, and the CIO holds regular meetings with our chief executive officer to discuss cyber related matters, information technology issues, and cybersecurity threats. To enhance awareness, monitoring, and oversight of cybersecurity risks, management also uses the following internal committees (in addition to the enterprise risk management committee discussed above): (1) the IT strategy and investment committee, which is comprised of senior executives and helps provide oversight of the investment and strategic direction for the Company’s IT function, (2) the IT steering committee, which is comprised of leaders from various business units and helps provide oversight and direction for inter- and intra-departmental IT related initiatives, and (3) the vulnerability management working group, which is comprised of IT leaders and helps establish appropriate roles, responsibilities, and escalation paths to resolve department and enterprise vulnerabilities within service level agreements.