Company: OSBC
Filing Date: 2025-04-01
Form Type: PRE 14A
Source: 0001558370-25-004277
Chunk: 24

Company: OLD SECOND BANCORP INC
Filing Date: 2025-04-01
Form: PRE 14A
Chunk 24
---
 matters. Additionally, each of our board-level committees provides regular reports to the full board and apprises the board of our comprehensive risk profile and any areas of concern.​​

#### 15
Cyber and Information Security Our Information Technology Steering Committee (“ITSC”) is central to the board’s oversight of cybersecurity risks, which are incorporated into our overall risk management program overseen by our Risk Committee. The board provides oversight of technology-based risk management on significant technology risk exposures such as risks related to information security, fraud, data protection, business continuity, vendor management and cybersecurity. The Chief Technology Officer, Chief Risk Officer and Chief Information Security Officer regularly attend the committee meetings and provide comprehensive briefings and reporting no less than quarterly to ensure the highest levels of management are kept abreast of the cybersecurity posture and potential risks we face. As the Bank deploys new technology and platform innovations to gather, process, analyze, and provide information to execute transactions and meet the needs of its customers, the Bank ensures that its operations are effective on enhancing productivity to meet its strategic goals while mitigating technology risks through its efforts to improve cybersecurity, data privacy, and data management. Board and ITSC members receive reporting on significant cyber events including response efforts, legal obligations, and notification to regulators and/or customers when needed. The Risk Committee has approved a standalone Cybersecurity Risk Appetite Statement against which the Bank’s performance is measured quarterly. While we look to numerous frameworks to ensure the Information Security Program is maintained in line with regulatory expectations and industry best practices, the National Institute of Standards and Technology (“NIST”) cybersecurity framework is the primary standard against which we benchmark ourselves. The program incorporates all of our security policies and covers the core elements of access control, infrastructure security, cybersecurity event and incident management, data protection, third-party vendor cyber risk oversight, payment security, and training and awareness. Independent assessment and benchmarking of the program are regularly completed. We continue to make significant investments in enhancing our cyber defense-in-depth capabilities and to strengthen our partnerships with the appropriate government and law enforcement agencies and other businesses in order to understand the full spectrum of cybersecurity risks in the operating environment, enhance defenses and improve resiliency against cybersecurity threats. We continually monitor our threat environment utilizing a robust asset management program, network security monitoring, regular patch management, threat intelligence, third party service oversight, and testing of key controls. We maintain a complex Business Continuity Plan and Incident Response Plan that is routinely updated and tested. Our staff receives formal information security training under a multifaceted approach that includes tabletop