Company: ONBPP
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0000707179-25-000005
Chunk: 75

Company: OLD NATIONAL BANCORP /IN/
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 75
---
 regulators, which could subject us to additional liability and reputational harm. Cybersecurity threats are expected to continue to be persistent and severe. For further discussion of such risks, see the section entitled “Risk Factors” in Item 1A of this Form 10-K under the heading “Operational Risks.”

CYBERSECURITY GOVERNANCE

The Company’s enterprise Information Security department is primarily responsible for monitoring and managing the Company’s ISP, under the supervision of Old National’s Chief Information Security Officer (“CISO”). The 

32

Information Security department’s responsibilities generally include cybersecurity risk assessment, identification and implementation of preventive measures, incident response, vulnerability assessment, threat intelligence, identity access governance, and business continuity and resilience.Old National has adopted an enterprise risk strategy, including for cybersecurity risks, premised on three lines of defense. While the Company expects the responsibilities described in the prior paragraph to be performed, monitored, and managed on a day-to-day basis by a “first line of defense” vested in the responsible business or function, the CISO and Information Security department representatives, as a key part of the Company’s Enterprise Risk Management department, serve as a “second line of defense” on cybersecurity matters, providing guidance, oversight, separate monitoring, and testing confirmation or challenge of the first line’s activities. The second line of defense function is separated from the first line of defense function through our organizational structure, with the CISO and other Information Security department personnel reporting into the Company’s Chief Risk Officer (the “CRO”). The Company’s Internal Audit function provides a “third line of defense,” in terms of periodically auditing overall program controls and effectiveness, using internal auditors with experience in auditing information technology matters. Our Chief Audit Executive and Ethics Officer supervises our Internal Audit department and reports to the Company’s Chief Executive Officer, while also maintaining a direct reporting relationship with the Chair of the Audit Committee of the Company’s Board of Directors.Old National’s Information Security Department includes information security professionals with a range of varying cybersecurity experience and education, many of whom have substantial experience assessing and managing cybersecurity initiatives and hold certain cybersecurity certifications. The Company’s CISO has extensive experience managing cybersecurity programs and assessing cybersecurity risks, with more than 30 years of experience in developing, managing, and testing information security and technology risk management programs. That includes over 13 years of experience in building and managing cybersecurity and technology risk programs for multi-national, Fortune 500 financial services firms, and over 10 years of experience building and managing information security consultancies specializing in cybersecurity program development