Company: FCNCB
Filing Date: 2025-02-21
Form Type: 10-K
Source: 0000798941-25-000010
Chunk: 112

Company: FIRST CITIZENS BANCSHARES INC /DE/
Filing Date: 2025-02-21
Form: 10-K
Item: Item 1C
Chunk 112
---
Item 1C. Cybersecurity

Risk Management and Strategy BancShares maintains robust processes for assessing, identifying, and managing material risks from cybersecurity threats that are integrated with our overall risk management program. As part of its cybersecurity risk management framework, BancShares leverages a Three Lines of Defense model (the “Three Lines Model”) to promote clarity of roles and responsibilities in managing risk. Under the Three Lines Model, the ECSO, led by our Chief Information Security Officer (the “CISO”), acts as a first line of defense and has primary responsibility for identifying, assessing, monitoring, and managing material risks from cybersecurity threats. Our CISO reports to our Chief Information and Operations Officer (“CIOO”), who reports directly to our Chief Executive Officer. Within ECSO, the Cyber Security Operation Center identifies, assesses, monitors, and manages potential cybersecurity events in coordination with the Enterprise Incident Management (“EIM”) team, escalating analysis and response to incidents and events in accordance with established procedures and the Enterprise Severity Matrix. In addition, BancShares maintains a third-party risk management team tasked with identifying, evaluating, and managing risk posed by all third-party engagements, including from cybersecurity threats.  The second-line independent risk management, including compliance, enterprise risk management, and operational risk management, works with the first line ECSO to evaluate, assess, and manage material risks using an established Risk Appetite Framework. The Risk Appetite Framework requires the cybersecurity organization to document the current risk landscape and the activities undertaken to mitigate risk that exceeds enterprise risk tolerance. The third-line in the Three Lines Model is our internal audit team, which assesses the effectiveness of related controls. BancShares maintains processes for reporting and escalation from each line of defense through management to senior leadership, to management-level committees, and to committees of the Board and the Board, as appropriate. Reporting includes top and emerging risks, and other operational risk metrics.   BancShares follows a defense-in-depth and layered-control framework to protect the organization against cybersecurity threats and attacks. ECSO remains committed to maintaining and improving preventative and detective controls and enhancing our defenses in response to the evolving threat landscape. This mission is supported by policy, standards, and procedures which align to industry frameworks, including the National Institute of Standards and Technology Cybersecurity Framework, and are executed through the firm’s preventive and detective controls. 

43

BancShares has implemented a threat awareness program that includes cross-organizational information sharing capabilities for threat intelligence and membership and engagement with intelligence communities, including but not limited to, the Financial Services Information Sharing and