XML 67 R36.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Overview
As mentioned immediately above, FHN's operational risk function is divided into several risk areas. Each area has been established at the corporate level to address risks in that area across the entire organization. One of those areas—information technology ("IT") risk—includes cybersecurity risk management.
As FHN manages it, IT risk includes cybersecurity risk, which in turn includes the risks from cyber fraud, cyber theft, cyber vandalism, cyber ransom, data and system security, and other unauthorized incursions into FHN's IT systems. IT risk management also includes IT system reliability, data integrity, IT aspects of regulatory compliance, and risks associated with the use of artificial intelligence tools and systems. The discussion in this section focuses on cybersecurity. Additional information on this topic is presented in Cybersecurity Risks within Item 1A beginning on page 35.
Key Cybersecurity Risk Management Goals
Cybersecurity risk management has two primary goals: defend FHN and its clients from fraudulent and other unauthorized incursions; and, when an incursion happens, detect and respond as soon as practical. The optimal cybersecurity program will defend as much as is practical while also detecting rapidly those incursions that get through.
Management Structure & Key Processes
Operational risk is managed by FHN's Operational Risk ("Op Risk") Committee. Members of the Op Risk Committee include senior-level representatives from these teams or departments: Enterprise Risk Management, Operations, Model Risk, Enterprise Data, Enterprise Technology, Enterprise Technology Risk Management, Credit and Credit Risk Management, Legal, Security, Internal Audit, Deposit & Loan Operations, Retail and Digital Banking, Regional Bank Products, Mortgage Banking, Accounting, and Fixed Income/Bond Trading. The Op Risk Committee reports to FHN's Management Risk Committee, which is headed by FHN's Chief Risk Officer, who reports to FHN's Chief Executive Officer.
IT risk is managed by the IT Risk Working Group, overseen by the Op Risk Committee. The IT Risk Working Group meets quarterly to discuss emerging cyber risks, regulatory changes, vendor risk, audits, and outstanding-issue resolution. The Group also provides updates to the Op Risk Committee on IT aspects of compliance, policies, and security standards. Members of the IT Risk Working Group include the head of Enterprise Technology along with personnel from nearly all of the teams and departments represented in Op Risk.
FHN also has a Cybersecurity Working Group. The Cybersecurity Working Group, which is outside of the risk
management hierarchy, meets quarterly. Its primary functions are to provide cybersecurity awareness to the executive leadership team and to provide high-level support if a significant cybersecurity event occurs. In connection with awareness, (a) external vendors, consultants, law enforcement, and other persons are invited to speak on industry-wide cybersecurity topics to provide an independent view of external threats facing the industry; and (b) members of the Enterprise Technology team provide updates regarding how FHN is addressing current risks and threats. The Cybersecurity Working Group includes: FHN's CEO; the heads of FHN's banking segments; the heads of Risk Management, Enterprise Technology, Security, Operations, and Legal; and senior personnel in the other teams and departments represented in the IT Risk Working Group.
Key leaders within these committees and groups and for these processes are FHN's Chief Information Officer and Chief Information Security Officer. The Chief Information Officer has substantial banking, IT, and related experience: had roles at FHN since 2009 related to IT and data systems culminating in CIO since 2020; prior to joining FHN, had roles at a large regional bank, including technology leader of the bank's electronic payments platform related to treasury management and enterprise IT architect; and, earned an MS in computer science as well as an MBA. The Chief Information Security Officer has over twenty years of banking, IT, and related experience: oversees information security and many related systems and processes; has established risk-based security programs to meet regulatory requirements and align with business needs; and has implemented numerous data protection, data access, and identity management systems.
FHN has a written Computer Security Incident Response Plan ("CSIRP") outlining FHN's incident response and communication processes. FHN's Chief Information Security Officer or certain other managers have the authority to initiate the execution of the CSIRP if an incident occurs. A working group called the Computer Security Incident Response Team has primary responsibility to implement or coordinate many of the CSIRP actions, along with FHN's IT Risk Working Group. Key goals of the CSIRP are to: contain, remediate, and recover; mitigate impact on FHN and clients; report findings to Op Risk and other senior management; and manage external communications. The Cybersecurity Working Group is informed of incidents that appear to have a significant risk of becoming material.
FHN engages third-party vendors to conduct several periodic cybersecurity reviews: Network Penetration testing; Cyber Security Maturity Assessment; Red Team (simulated cyber-attack) testing; SOX (financial reporting controls and data integrity) testing; and, PCI-DSS (proprietary data security standard for payment systems)
attestation of compliance and SOC 1 Type II reports (attesting to the design and operation of cybersecurity systems) for lockbox and electronic bill pay. The frequency of these reviews ranges from several times per year to every three years. FHN also has a cybersecurity incident specialty firm on retainer for incident response, as needed.
FHN has a dedicated Third-Party Risk Management ("TPRM") department reporting to the Chief Risk Officer. TPRM engages the IT Risk and Control Team to perform cybersecurity assessments for new vendors during onboarding, re-assessments of existing vendors on a risk-based cadence, and continuous monitoring of critical third parties.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] As FHN manages it, IT risk includes cybersecurity risk, which in turn includes the risks from cyber fraud, cyber theft, cyber vandalism, cyber ransom, data and system security, and other unauthorized incursions into FHN's IT systems. IT risk management also includes IT system reliability, data integrity, IT aspects of regulatory compliance, and risks associated with the use of artificial intelligence tools and systems. The discussion in this section focuses on cybersecurity.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Board Oversight
The Board's Risk Committee oversees all risk management functions for the enterprise, including operational risk, IT risk, and cybersecurity risk. The Risk Committee, as well as the full Board, each quarter receives a risk management update from FHN's Chief Risk Officer. Each update includes a written presentation covering all major risk areas, including operational risk, and each is supported by a detailed Enterprise Risk Report which is available to all directors. Major topics in the operational risk portion of the Enterprise Risk Report each quarter include fraud and related incidents; process management, which includes
many processes related to cybersecurity defenses; and information security, which addresses core cybersecurity processes and incidents.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Risk Committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
The Board's Risk Committee oversees all risk management functions for the enterprise, including operational risk, IT risk, and cybersecurity risk. The Risk Committee, as well as the full Board, each quarter receives a risk management update from FHN's Chief Risk Officer. Each update includes a written presentation covering all major risk areas, including operational risk, and each is supported by a detailed Enterprise Risk Report which is available to all directors. Major topics in the operational risk portion of the Enterprise Risk Report each quarter include fraud and related incidents; process management, which includes
many processes related to cybersecurity defenses; and information security, which addresses core cybersecurity processes and incidents.
Cybersecurity Risk Role of Management [Text Block]
FHN also has a Cybersecurity Working Group. The Cybersecurity Working Group, which is outside of the risk
management hierarchy, meets quarterly. Its primary functions are to provide cybersecurity awareness to the executive leadership team and to provide high-level support if a significant cybersecurity event occurs. In connection with awareness, (a) external vendors, consultants, law enforcement, and other persons are invited to speak on industry-wide cybersecurity topics to provide an independent view of external threats facing the industry; and (b) members of the Enterprise Technology team provide updates regarding how FHN is addressing current risks and threats. The Cybersecurity Working Group includes: FHN's CEO; the heads of FHN's banking segments; the heads of Risk Management, Enterprise Technology, Security, Operations, and Legal; and senior personnel in the other teams and departments represented in the IT Risk Working Group.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
FHN also has a Cybersecurity Working Group. The Cybersecurity Working Group, which is outside of the risk
management hierarchy, meets quarterly. Its primary functions are to provide cybersecurity awareness to the executive leadership team and to provide high-level support if a significant cybersecurity event occurs. In connection with awareness, (a) external vendors, consultants, law enforcement, and other persons are invited to speak on industry-wide cybersecurity topics to provide an independent view of external threats facing the industry; and (b) members of the Enterprise Technology team provide updates regarding how FHN is addressing current risks and threats. The Cybersecurity Working Group includes: FHN's CEO; the heads of FHN's banking segments; the heads of Risk Management, Enterprise Technology, Security, Operations, and Legal; and senior personnel in the other teams and departments represented in the IT Risk Working Group.
Key leaders within these committees and groups and for these processes are FHN's Chief Information Officer and Chief Information Security Officer.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Chief Information Officer has substantial banking, IT, and related experience: had roles at FHN since 2009 related to IT and data systems culminating in CIO since 2020; prior to joining FHN, had roles at a large regional bank, including technology leader of the bank's electronic payments platform related to treasury management and enterprise IT architect; and, earned an MS in computer science as well as an MBA. The Chief Information Security Officer has over twenty years of banking, IT, and related experience: oversees information security and many related systems and processes; has established risk-based security programs to meet regulatory requirements and align with business needs; and has implemented numerous data protection, data access, and identity management systems.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
FHN has a written Computer Security Incident Response Plan ("CSIRP") outlining FHN's incident response and communication processes. FHN's Chief Information Security Officer or certain other managers have the authority to initiate the execution of the CSIRP if an incident occurs. A working group called the Computer Security Incident Response Team has primary responsibility to implement or coordinate many of the CSIRP actions, along with FHN's IT Risk Working Group. Key goals of the CSIRP are to: contain, remediate, and recover; mitigate impact on FHN and clients; report findings to Op Risk and other senior management; and manage external communications. The Cybersecurity Working Group is informed of incidents that appear to have a significant risk of becoming material.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true