Disclosure · Form 10-K · fiscal 2025
First Commonwealth Financial Corp 10-K cybersecurity disclosure (Item 1C), fiscal 2025
Filed March 2, 2026· period ended December 31, 2025· FCF· CIK 712537· Updated · filing on sec.gov ↗
First Commonwealth Financial Corp's Form 10-K for fiscal 2025, filed March 2, 2026, names the Chief Information Security Officer as its top security role, reporting to the Chief Risk Officer, with oversight by the Risk Committee.
What First Commonwealth Financial's Item 1C says
First Commonwealth Financial's Form 10-K for fiscal 2025 places oversight of the information security program with the Risk Committee of the board. The Chief Information Security Officer is part of the risk management function and reports directly to the Chief Risk Officer.
Board and management oversight
The Risk Committee oversees management's actions to identify, assess, mitigate, and remediate material cyber issues and risks. The CISO provides quarterly reports to the Risk Committee on information security programs, key enterprise cyber initiatives, and significant cybersecurity and privacy incidents. Various management committees provide oversight of the information security and technology programs. These committees generally meet quarterly, and summaries of key issues discussed and actions taken are provided to the Risk Committee.
Who leads security
The CISO reports directly to the Chief Risk Officer, who in turn reports directly to the CEO.
How the company manages cyber risk
The company structures its information security program around the National Institute of Standards and Technology Cybersecurity Framework, regulatory guidance, and other industry standards. The company has established processes and systems to mitigate cyber risk, including regular education and training, preparedness simulations and tabletop exercises, and recovery and resilience tests. Internal and external auditors, Federal and State bank examiners, and independent external partners periodically review the company's processes, systems and controls.
Third parties and incidents
The company engages third party security experts to supplement its internal Information Security team and for assessments, penetration tests and program enhancements. The company engages external experts, including cybersecurity assessors, consultants, auditors, and legal counsel, in evaluating and testing its risk management systems. In the past three years, the company has not experienced any material computer data security breaches resulting from a compromise of its information systems.
What the section does not state
The section does not name the person who holds the top security role.
Read from the Form 10-K filed March 2, 2026, on . Every sentence rests on a passage of the section reproduced below.
The filing's fields, each with its sentence
Who leads security (the top role, as the filing names it)
Chief Information Security Officer
Reports to
Chief Risk Officer
“Our CISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to our CEO.”
Board oversight
Risk Committee
“Specifically, the Risk Committee is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate material cyber issues and risks.”
CISO or other person named
not identified
Frameworks and standards named
NIST Cybersecurity Framework
Where the filing names it
- NIST Cybersecurity Framework: “We structure our information security program around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards.”
Outside assessors, consultants or testers
Described
“We engage third party security experts to supplement our internal Information Security team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement.”
Experience of the security leadership, as stated
not identified
Material incident
The filing states none
“In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware of any significant cybersecurity breach or attack that had a material impact on our business or operating results.”
The section
557 words, Form 10-K filed March 2, 2026 for the period ended December 31, 2025
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
How peers in the same industry describe the seat
The SEC assigns First Commonwealth Financial Corp standard industrial classification 6021, National commercial banks (SEC SIC list). 8 other filers in our library have the same code.
| Filer | Top security role | Reports to | Board oversight |
|---|---|---|---|
| Community BancorpFY 2025, filed March 27, 2026 | Information Security Officer | not identified | full board |
| Chain Bridge Bancorp IncFY 2025, filed March 20, 2026 | Director of Technology | Chief Executive Officer | Risk Committee |
| ENB Financial CorpFY 2025, filed March 20, 2026 | Chief Information Security Officer | Chief Risk Officer | full board |
| Smartfinancial Inc.FY 2025, filed March 16, 2026 | Information Security Officer | Chief Risk Officer | Audit Committee |
| Ames National CorpFY 2025, filed March 12, 2026 | Chief Information Officer | not identified | full board |
| Arrow Financial CorpFY 2025, filed March 6, 2026 | Chief Information Officer | not identified | not identified |
| Camden National CorpFY 2025, filed March 6, 2026 | SVP, Director of Information Security | CRO | Audit Committee |
| Amerant Bancorp Inc.FY 2025, filed February 27, 2026 | Chief Information Security Officer | Chief Risk Officer | Risk Committee |
Item 1C, verbatim from the filing
The text below is the Cybersecurity item of First Commonwealth Financial Corp's Form 10-K as filed with the SEC on March 2, 2026, reproduced word for word from the filing on sec.gov. Page numbers and navigation lines have been removed; nothing has been added. It describes governance as of that date.
ITEM 1C. Cybersecurity
Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as personal information of depositors and borrowers and information about our employees, contractors, vendors, and suppliers. We rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks.
Cybersecurity Governance
Our Board is actively engaged in the oversight of our cybersecurity program. Specifically, the Risk Committee is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate material cyber issues and risks. Our Chief Information Security Officer ("CISO") provides quarterly reports to the Risk
Committee regarding information security programs, key enterprise cyber initiatives, and significant cybersecurity and privacy incidents.
Our CISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to our CEO. Various management committees provide oversight of the information security and technology programs. These committees generally meet quarterly, and summaries of key issues discussed and actions taken are provided to the Risk Committee.
Cybersecurity Risk Management and Strategy
We structure our information security program around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. We leverage industry and government associations, third-party benchmarking, audits and threat intelligence feeds to promote program effectiveness. Our CISO, along with key members of their team, regularly collaborate with peer banks, industry groups, and policymakers.
We employ an in-depth, layered, defensive strategy with respect to our products, services and technology. We leverage people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.
We have established processes and systems to mitigate cyber risk, including regular education and training, preparedness simulations and tabletop exercises, and recovery and resilience tests. Our processes, systems and controls are reviewed periodically by internal and external auditors, Federal and State bank examiners, and independent external partners to assess design and operating effectiveness. We also maintain information security risk insurance coverage.
We engage third party security experts to supplement our internal Information Security team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.
We engage with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.
In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware of any significant cybersecurity breach or attack that had a material impact on our business or operating results.
Earlier filings on record
Fiscal 2024 Form 10-K, filed March 3, 2025 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
Chief Risk Officer
“Our CISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to our CEO.”
Board oversight
Risk Committee
“Specifically, the Risk Committee is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate material cyber issues and risks.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware of any significant cybersecurity breach or attack that had a material impact on our business or operating results to date.”
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
ITEM 1C. Cybersecurity
Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as personal information of depositors and borrowers and information about our employees, contractors, vendors, and suppliers. We rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks.
Cybersecurity Governance
Our Board is actively engaged in the oversight of our cybersecurity program. Specifically, the Risk Committee is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate material cyber issues and risks. Our Chief Information Security Officer ("CISO") provides quarterly reports to the Risk Committee regarding information security programs, key enterprise cyber initiatives, and significant cybersecurity and privacy incidents.
Our CISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to our CEO. Various management committees provide oversight of the information security and technology programs. These committees generally meet quarterly, and summaries of key issues discussed and actions taken are provided to the Risk Committee.
Cybersecurity Risk Management and Strategy
We structure our information security program around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. We leverage industry and government associations, third-party benchmarking, audits and threat intelligence feeds to promote program effectiveness. Our CISO, along with key members of their team, regularly collaborate with peer banks, industry groups, and policymakers.
We employ an in-depth, layered, defensive strategy with respect to our products, services and technology. We leverage people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.
We have established processes and systems to mitigate cyber risk, including regular education and training, preparedness simulations and tabletop exercises, and recovery and resilience tests. Our processes, systems and controls are reviewed periodically by internal and external auditors, Federal and State bank examiners, and independent external partners to assess design and operating effectiveness. We also maintain information security risk insurance coverage.
We engage third party security experts to supplement our internal Information Security team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.
We engage with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.
In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware of any significant cybersecurity breach or attack that had a material impact on our business or operating results to date.
Fiscal 2023 Form 10-K, filed February 29, 2024 sec.gov ↗
Top security role, as the filing names it
Chief Information Security Officer
Reports to, as the filing names it
Chief Risk Officer
“Our CISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to our CEO.”
Board oversight
Risk Committee
“Specifically, the Risk Committee is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate material cyber issues and risks.”
Person named in the filing
not identified
Experience, as stated
not identified
Material incident
The filing states none
“In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware and have not had a significant cybersecurity breach or attack that had a material impact on our business or operating results to date.”
Read by claude-sonnet-5-5 on October 26, 2026; every quote verified in the stored text by code.
ITEM 1C. Cybersecurity
Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as personal information of depositors and borrowers and information about our employees, contractors, vendors, and suppliers. We rely heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks.
Cybersecurity Governance
Our Board is actively engaged in the oversight of our cybersecurity program. Specifically, the Risk Committee is responsible for overseeing our information security program, including management's actions to identify, assess, mitigate, and remediate material cyber issues and risks. Our Chief Information Security Officer ("CISO") provides quarterly reports to the Risk Committee regarding information security programs, key enterprise cyber initiatives, and significant cybersecurity and privacy incidents.
Our CISO is part of the risk management function, reporting directly to the Chief Risk Officer, who in turn, reports directly to our CEO. Various management committees provide oversight of the information security and technology programs. These committees generally meet quarterly and summaries of key issues discussed and actions taken are provided to the Risk Committee.
Cybersecurity Risk Management and Strategy
We structure our information security program around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. We leverage industry and government associations, third-party benchmarking, audits and threat intelligence feeds to promote program effectiveness. Our CISO, along with key members of their team, regularly collaborate with peer banks, industry groups, and policymakers.
We employ an in-depth, layered, defensive strategy with respect to our products, services and technology. We leverage people, processes and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective
tools designed to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats.
We have established processes and systems to mitigate cyber risk, including regular education and training, preparedness simulations and tabletop exercises, and recovery and resilience tests. Our processes, systems and controls are reviewed periodically by internal and external auditors, Federal and State bank examiners, and independent external partners to assess design and operating effectiveness. We also maintain information security risk insurance coverage.
We engage third party security experts to supplement our internal Information Security team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.
We engage with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.
In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware and have not had a significant cybersecurity breach or attack that had a material impact on our business or operating results to date.
The fields above are exact quotes from the stored text. "Not identified" means no supporting sentence was found, not that the company has no such arrangement. A name in a filing is not a record of who holds the seat today: the Wire tracks that.
Browse the whole library at /disclosures, or see who the top security role reports to, by sector. Cite as "CISO Tribune, 10-K cybersecurity governance disclosures" with a link.