Company: FITBI
Filing Date: 2025-02-24
Form Type: 10-K
Source: 0000035527-25-000079
Chunk: 412

Company: FIFTH THIRD BANCORP
Filing Date: 2025-02-24
Form: 10-K
Item: Item 1C
Chunk 412
---
ITEM 1C. CYBERSECURITY

The Bancorp recognizes the importance of maintaining a cybersecurity risk management system designed to reduce the risks that cybersecurity threats pose to financial institutions. As such, the Bancorp has adopted proactive and defensive safeguards intended to better protect the Bancorp’s information assets and supporting infrastructures from technology-related attacks. The Bancorp’s Board of Directors and management oversee its information security and cybersecurity risk management programs. As further discussed below, the Bancorp has established various programs, policies and procedures which are designed to proactively protect information assets. However, not all incidents can be prevented. As a result, the Bancorp has also established various policies and procedures governing how to respond to security incidents, with the objective of minimizing any potential impacts. As of December 31, 2024, the Bancorp is not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect Fifth Third, including its business strategies, results of operations or financial condition. Risk Assessment and ManagementThe Bancorp maintains a variety of programs and policies to support the management of cybersecurity risk within the organization with a focus on prevention, detection and response processes. These programs and policies leverage frameworks and controls from the National Institute of Standards and Technology as well as various other regulatory requirements and industry-specific standards. The Bancorp also participates in the federally recognized Financial Services Information Sharing and Analysis Center and requires its employees and contractors to complete various education and training programs related to information security.The Bancorp’s Information Technology (“IT”) and Information Security (“IS”) teams have the primary responsibility for establishing appropriate policies and procedures that are responsive to cybersecurity threats and other information security risks. The Bancorp’s Information Technology and Cybersecurity Risk Management (“IT CSRM”) team, as part of the Bancorp’s Risk Management division, provides independent risk management oversight to those IT and IS teams. In addition to the Board oversight discussed below, the Bancorp’s Internal Audit function independently oversees, reviews and validates these activities and reports to the Board of Directors on the effectiveness of governance, risk management and internal controls.The Bancorp has established an Enterprise Risk Management Framework which informs the Bancorp’s risk management programs. As part of this framework, the IT CSRM team maintains the Bancorp’s IT CSRM Program, which is designed to identify, assess, manage, monitor and report cybersecurity risks as part of the Bancorp’s independent risk management function. The IT CSRM team is responsible for defining the risk management practices set forth in the IT CSRM Program. Refer to the Risk Management – Overview