Company: FRME
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000712534-25-000058
Chunk: 168

Company: FIRST MERCHANTS CORP
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1A
Chunk 168
---
 or harmful actions across our information technology environment.  Standards over information security are Board-approved and various types of control testing is conducted throughout the year, both by internal parties and external ones.  Findings are actioned on throughout the year and reported to various committees.  The Corporation has adopted the National Institute of Standards and Technology (NIST) Cybersecurity Framework for the management and development of cyber-security controls and is an active participant in the financial sector information sharing organization structure, known as the Financial Services Information Sharing and Analysis Center. 

Each year the Information Security Department conducts a cyber incident tabletop exercise for the bank’s incident response teams.  The bank’s executive management team participates in the exercise every two years.  The purpose of these tabletops is to simulate a cyber event and work through the event using our Incident Response Plan.  This allows our incident response team to become familiar with the logistics of the plan, as well as provide feedback to improve the process and plan.  External subject matter experts, such as Bank legal counsel, forensic advisors, marketing agency and insurance broker participate in these exercises.  

Management has established an Information Security Committee in order to assist executive management and the Board of Directors of the Bank in fulfilling their oversight responsibilities related to information security.  The Committee reports its activities, key conclusions and recommendations to the Enterprise Risk Management Committee and the Board’s Risk and Credit Policy Committee of the Board on a quarterly basis. 

At the Information Security Committee, security-related policies and standards are reviewed and approved, annual risk assessment results and action plans are noted, annual penetration test reports shared, current security incidents discussed, and relevant cyber risks and trends are presented.

24

PART I: ITEM 1A., ITEM 1B., AND ITEM 1C.

The Corporation’s Board of Directors has delegated primary responsibility for oversight of cybersecurity risk to its Risk and Credit Policy Committee, with its Audit Committee also considering cyber risk as part of financial oversight.  The Information Security Department provides an annual update to the Risk and Credit Policy Committee of the Board on the state of the Information Security Program.  This cybersecurity “deep dive” includes review of key security incidents and review of the Information Security Policy, Information Security Program, the Incident Response Plan, and the Acceptable Use Policy.  The Board is then presented with the update by the Chair of the Risk and Credit Policy Committee.

The Board considers cybersecurity risks in business strategy by getting updates on the Bank’s cybersecurity risk assessment.  It assesses the experience of management personnel responsible for preventing, mitigating, detecting