Company: ONBPP
Filing Date: 2025-02-19
Form Type: 10-K
Source: 0000707179-25-000005
Chunk: 74

Company: OLD NATIONAL BANCORP /IN/
Filing Date: 2025-02-19
Form: 10-K
Item: Item 1C
Chunk 74
---
 our layered defenses by performing simulations and tabletop exercises (including at a management level) and drills at both a technical level (including through penetration tests) and by review of our information security policies, practices and procedures with third-party consultants. Our ISP team monitors alerts and meets with business managers to discuss threat levels, emerging threats or trends, and available mitigation or remediation approaches and tools. The team also regularly collects and communicates to management relevant data on cybersecurity threats and risks, including through monthly cybersecurity scorecards on the status of and potential risks to key initiatives and controls, and conducts an enterprise-wide cybersecurity risk assessment at least annually.In addition, we obtain inputs from industry and government associations, third-party benchmarking, and threat intelligence resources and updates. We leverage internal auditors and third-party consultants to periodically review the processes, systems, and controls underlying our ISP and assess their design, operating efficacy, and program maturity, as well as to make recommendations to enhance their currency and effectiveness.The Company also maintains a Third-Party Risk Management (“TPRM”) program designed to identify, assess, and manage enterprise risks, including cybersecurity risks, inherent in or potentially associated with the Company’s external service providers and other third parties in its supply chain. TPRM leaders report into and operate under the supervision of our Corporate Risk Management department. The TPRM program seeks to build into the Company’s business processes an appropriate level of cybersecurity due diligence prior to engagement of, and during the relationship lifecycle with, third parties. We generally seek security-related confirmations from our third-party suppliers, including as to their adherence to appropriate information handling and asset management requirements and their provision to us of notifications in the event of any known or suspected cybersecurity incidents.While we have no knowledge that we have experienced a cybersecurity incident that has had or is reasonably likely to have a material adverse impact on our operations or financial results as of the date of this Form 10-K, there can be no assurance that we will not encounter such an incident in the future, notwithstanding the cybersecurity measures and processes we have undertaken. Such incidents, whether or not successful, could result in our incurring significant costs related to, for example, remediating or restoring our internal systems or information, implementing additional threat protection measures, defending against litigation, responding to regulatory inquiries or actions, paying damages, providing customers with incentives to maintain a business relationship with us, or taking other remedial steps with respect to third parties, as well as incurring significant reputational harm. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to