Company: RNST
Filing Date: 2025-02-26
Form Type: 10-K
Source: 0000715072-25-000054
Chunk: 74

Company: RENASANT CORP
Filing Date: 2025-02-26
Form: 10-K
Item: Item 1C
Chunk 74
---
. The information security program is designed to comply with applicable laws and regulations and is driven by industry standards for financial institutions, including the Federal Financial Institutions Examination Council (“FFIEC”) Cybersecurity Assessment Tool, as well as by the guidance promulgated by the National Institute of Standards and Technology (“NIST”). We work closely with government and industry associations to stay abreast of developments and share best practices with respect to cybersecurity. The following paragraphs describe how we test, or otherwise obtain feedback about, the Company’s cybersecurity and other information security. The feedback we develop through testing and assessment, in addition to information about cybersecurity threats or incidents impacting other entities, is incorporated into the Company’s information security program to enhance our cybersecurity; in certain circumstances a new or emerging cybersecurity threat may require modifications to how we conduct business.The Company’s information security team utilizes the Financial Services Sector Coordinating Council for Critical Infrastructure Protection and Homeland Security version of the FFIEC Cybersecurity Assessment Tool to perform an annual assessment of our information security program. The assessment provides a repeatable and measurable process for institutions to measure their cybersecurity preparedness over time. The assessment incorporates cybersecurity-related principles from the FFIEC Information Technology Examination Handbook and regulatory guidance, and concepts from other industry standards, including the NIST Cybersecurity Framework.The assessment consists of two parts: Inherent Risk Profile and Cybersecurity Maturity. The Cybersecurity Maturity aspect of the assessment is designed to help management measure the institution’s level of risk and corresponding controls. The levels range from baseline to innovative. Cybersecurity Maturity includes tests to determine whether an institution’s behaviors, practices and processes can support cybersecurity preparedness within the following five domains:•Cyber risk management and oversight•Threat intelligence and collaboration•Cybersecurity controls•External dependency management•Cyber incident management and resilienceWe also retain third parties to test the effectiveness of our cybersecurity efforts. Annually, we obtain independent third party audits of the information security program, including program maturity and overall control effectiveness. In addition, multiple times over the course of each year we engage third party security firms to conduct both external and internal penetration tests. The goal of these assessments is to discover vulnerabilities in the Company’s in-scope corporate networks. When testing reveals potential vulnerabilities in the Company’s security, management works to develop appropriate mitigation plans to resolve any outstanding issues; we also consider other recommendations to enhance our cybersecurity that these security firms may offer, implementing those that management concludes are appropriate within the context of the Company’s information security program and processes.In addition to audits and testing by