XML 65 R35.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Overview
Cybersecurity risk includes the risks from cyber fraud, cyber theft, cyber vandalism, cyber ransom, data and system security, and other unauthorized incursions into FHN's IT systems. Additional information on this topic is presented in Cybersecurity Risks within Item 1A beginning on page 24.
Key Cybersecurity Risk Management Goals
Cybersecurity risk management has two primary goals: defend FHN and its clients from fraudulent and other unauthorized incursions; and, when an incursion happens, detect and respond as soon as practical. The optimal cybersecurity program will defend as much as is practical while also detecting rapidly those incursions that get through.
Management Structure & Key Processes
Operational risk, including cybersecurity risk, is overseen by FHN's Operational Risk Committee. Members of the Operational Risk Committee include senior-level representatives from across FHN. The Operational Risk Committee reports to FHN's Management Risk Committee, which is headed by FHN's Chief Risk Officer.
The IT & Information Security Working Group meets quarterly to discuss emerging cyber risks, regulatory changes, vendor risk, audits, and outstanding-issue resolution. The Group also provides updates to the
Operational Risk Committee on cybersecurity aspects of compliance, policies, and security standards.
The key leaders for these committees, groups, and processes at FHN are the Chief Information Officer and Chief Information Security Officer. The Chief Information Officer has substantial banking, IT, and related experience: has held roles at FHN since 2009 related to IT and data systems, culminating in CIO in 2020; prior to joining FHN, had roles at a large regional bank, including technology leader of the bank's electronic payments platform related to treasury management and enterprise IT architect; and, earned an MS in computer science as well as an MBA. The Chief Information Security Officer who held that position during 2025 had over twenty years of banking, IT, and related experience: oversaw information security and many related systems and processes; established risk-based security programs to meet regulatory requirements and align with business needs; and implemented numerous data protection, data access, and identity management systems. In 2026, FHN appointed a new Chief Information Security Officer who: prior to joining FHN, had roles at two large U.S. banks and a financial services firm; has over twenty-five years of leadership experience in information security, risk management, and technology; directed complex programs in technology strategy, program and project management, business development, application development, and large-scale system implementations; and led the execution of a multi-year enterprise-wide cyber strategy.
FHN has a written Computer Security Incident Response Plan ("CSIRP") outlining FHN's incident response and communication processes. FHN's Chief Information Security Officer or certain other managers have the authority to initiate the execution of the CSIRP if an incident occurs. A working group called the Computer Security Incident Response Team has primary responsibility to implement or coordinate many of the CSIRP actions, along with FHN's IT & Information Security Working Group. Key goals of the CSIRP are to: contain, remediate, and recover; mitigate impact on FHN and clients; report findings to Operational Risk and other senior management; and manage external communications. FHN periodically conducts response readiness exercises, including simulated cyber-attack scenarios, to test the effectiveness of the CSIRP and ensure resources are prepared to execute response actions in real time.
FHN engages third-party vendors to conduct several periodic cybersecurity reviews: Network Penetration testing; Cyber Security Maturity Assessment; Red Team (simulated cyber-attack) testing; SOX (financial reporting controls and data integrity) testing; and, PCI-DSS (proprietary data security standard for payment systems) attestation of compliance and SOC 1 Type II reports (attesting to the design and operation of cybersecurity systems) for lockbox and electronic bill pay. The frequency of these reviews ranges from several times per year to every three years. FHN also has a cybersecurity incident specialty firm on retainer for incident response, as needed.
FHN has a dedicated Third-Party Risk Management ("TPRM") department which oversees third party vendors and reports up through the Chief Risk Officer. Among other responsibilities, TPRM engages the IT Risk and Control Team to perform cybersecurity assessments for new vendors during onboarding, re-assessments of existing vendors on a risk-based cadence, and continuous monitoring of critical third parties.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Cybersecurity risk includes the risks from cyber fraud, cyber theft, cyber vandalism, cyber ransom, data and system security, and other unauthorized incursions into FHN's IT systems.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Board Oversight
The Board's Risk Committee oversees all risk management functions for the enterprise, including operational risk,
which encompasses cybersecurity risk. The Risk Committee, as well as the full Board, each quarter receives a risk management update from FHN's Chief Risk Officer. Each update includes a written presentation covering all major operational risk areas, including cybersecurity risk.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Risk Committee
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block]
The Board's Risk Committee oversees all risk management functions for the enterprise, including operational risk,
which encompasses cybersecurity risk. The Risk Committee, as well as the full Board, each quarter receives a risk management update from FHN's Chief Risk Officer. Each update includes a written presentation covering all major operational risk areas, including cybersecurity risk.
Cybersecurity Risk Role of Management [Text Block]
Operational risk, including cybersecurity risk, is overseen by FHN's Operational Risk Committee. Members of the Operational Risk Committee include senior-level representatives from across FHN. The Operational Risk Committee reports to FHN's Management Risk Committee, which is headed by FHN's Chief Risk Officer.
The IT & Information Security Working Group meets quarterly to discuss emerging cyber risks, regulatory changes, vendor risk, audits, and outstanding-issue resolution. The Group also provides updates to the
Operational Risk Committee on cybersecurity aspects of compliance, policies, and security standards.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The key leaders for these committees, groups, and processes at FHN are the Chief Information Officer and Chief Information Security Officer.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Chief Information Officer has substantial banking, IT, and related experience: has held roles at FHN since 2009 related to IT and data systems, culminating in CIO in 2020; prior to joining FHN, had roles at a large regional bank, including technology leader of the bank's electronic payments platform related to treasury management and enterprise IT architect; and, earned an MS in computer science as well as an MBA. The Chief Information Security Officer who held that position during 2025 had over twenty years of banking, IT, and related experience: oversaw information security and many related systems and processes; established risk-based security programs to meet regulatory requirements and align with business needs; and implemented numerous data protection, data access, and identity management systems. In 2026, FHN appointed a new Chief Information Security Officer who: prior to joining FHN, had roles at two large U.S. banks and a financial services firm; has over twenty-five years of leadership experience in information security, risk management, and technology; directed complex programs in technology strategy, program and project management, business development, application development, and large-scale system implementations; and led the execution of a multi-year enterprise-wide cyber strategy.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block]
FHN has a written Computer Security Incident Response Plan ("CSIRP") outlining FHN's incident response and communication processes. FHN's Chief Information Security Officer or certain other managers have the authority to initiate the execution of the CSIRP if an incident occurs. A working group called the Computer Security Incident Response Team has primary responsibility to implement or coordinate many of the CSIRP actions, along with FHN's IT & Information Security Working Group. Key goals of the CSIRP are to: contain, remediate, and recover; mitigate impact on FHN and clients; report findings to Operational Risk and other senior management; and manage external communications. FHN periodically conducts response readiness exercises, including simulated cyber-attack scenarios, to test the effectiveness of the CSIRP and ensure resources are prepared to execute response actions in real time.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true