Company: TFC
Filing Date: 2025-03-17
Form Type: DEF 14A
Source: 0001193125-25-055156
Chunk: 37

Company: TRUIST FINANCIAL CORP
Filing Date: 2025-03-17
Form: DEF 14A
Chunk 37
---
 Insurance Holdings, LLC (“TIH”), which was completed during the second quarter of 2024, the Board revised the Company’s Strategic Plan and the Profit Plan to reflect the TIH sale and subsequent strategic balance sheet repositioning, including removing TIH earnings, incorporating discontinued operations accounting related to the TIH sale, and adding net interest income from the reinvestment of proceeds from the TIH sale and balance sheet repositioning. These adjustments were necessary to provide a more accurate representation of the Company’s expected financial performance for the 2024 fiscal year. For purposes of this proxy statement, we refer to the initially-approved Profit Plan for 2024 as the “Original Plan” and the revised Profit Plan as the “Final Plan.” Information Security/Cybersecurity Like other financial services firms, Truist faces an increasingly complex and evolving cybersecurity threat environment. We maintain a risk-based cybersecurity framework that is part of our ERM Framework. It is implemented through people, processes, and technology, whereby we assess, identify, and manage material risks from cybersecurity threats and seek to adapt our risk mitigation activities accordingly. Our Board has primary responsibility for the oversight of our enterprise risk management and exercises its oversight function in respect of cybersecurity risk through the Risk Committee. The Risk Committee is responsible for overseeing Truist’s risk management function, including approving and reviewing Truist’s risk management framework and policies, and overseeing management’s implementation of such framework and policies. Our information security program, which specifies how we execute our cybersecurity framework, is operated and maintained by management, including the Chief Information Officer, the Chief Information Security Officer, and the Chief Risk Officer. These senior officers are responsible for assessing and managing Truist’s cybersecurity risks. Our information security program also includes processes for escalating and considering the materiality of incidents that impact Truist, including escalation to executive management and the Board, which are periodically tested through tabletop exercises to assess Truist’s preparedness. Our cybersecurity framework strategy, which is overseen by the Chief Information Security Officer, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing. For more information on our management of cybersecurity risks, please see the “Cybersecurity” section of our Annual Report on Form 10-Kfor the year ended December 31, 2024. Statement of Political Engagement Our executive officers have direct responsibility for our political activities, while our Nominating and Governance Committee oversees the Company’s policies and practices relating to political contributions and lobbying. A