Our Commitment to Cybersecurity

Information Security relates to the protection of PNC information systems, proprietary data, and customer information. The Information Security Program governs access to, and use of, PNC information and information assets, leveraging accepted information security industry standards. The program is designed to safeguard our client and company assets from external and internal information security threats. The PNC Program provides:

PNC’s Information Security team works proactively to identify, contain and mitigate threats and defend our systems, networks and data. We have experience in areas including access control, control integrity, vendor management, security architecture, network intrusion detection, vulnerability management, data loss prevention and incident response. In addition, we maintain an active cyber intelligence collection and sharing program.

In furtherance of these objectives, PNC’s Information Security program is organized into the following major functional areas:

1. Access Management: Access Management is PNC’s program for governing access to information systems and technology and tailoring such access to that which is needed for employees to perform their job functions. Security controls designed to prevent unauthorized access and misuse of data are in place. PNC’s Access Management Program provides integrity, privacy and consistency of financial, business and customer information through data ownership, appropriate access and governance.
2. Control Integrity: Control Integrity seeks to provide a stable, resilient and reliable operating environment by applying security controls, hardening standards and Line of Business (LOB) security liaisons and secure development rigor to the PNC enterprise.
3. Security Assessment & Awareness: Security Assessment & Awareness manages the risk to PNC from the use of third party suppliers and provides corporate customers information concerning the security controls PNC employs to manage information security risks within the PNC products and services they utilize. The program also provides training to PNC staff on information security threats to help manage risk.
4. Cryptographic Management: Cryptographic Management provides enterprise PKI and key management services to position Information Security to protect and defend PNC.
5. Cyber Operations: PNC’s Cyber Operations team is tasked to prevent, detect, respond and neutralize hostile actors and malicious software posing a potential threat to PNC’s enterprise network. Cyber Operations protects information assets by centrally facilitating the monitoring, tracking and response to suspicious or malicious activity against PNC. To effectively deal with the various enterprise cyber attacks, Cyber Operations is comprised of teams working cohesively to deliver streamlined cyber security operations to protect the enterprise. The program also provides identification and analysis of emerging risks and threats across the technology landscape.
6. Vulnerability Assessment & Penetration Testing: The Ethical Hacking Team provides security penetration testing and code checking capabilities to the PNC Enterprise. The Attack Surface Management Team provides vulnerability scanning capabilities. The scope of this program covers network and technical infrastructure in addition to the inventory of applications, including remediation and tracking of identified vulnerabilities.
7. Security Engineering & Architecture (SEA): SEA provides comprehensive management of security infrastructure, issue resolution, security architecture guidance and the design and deployment of new security solutions. The SEA team also provides expert level consulting to other teams within Information Security and PNC. The SEA team deploys, operates and maintains security products and technologies utilized by Information Security.

PNC Information Security Policies establish roles, responsibilities, standards and procedures for both physical and electronic data protection. These policies are implemented throughout the enterprise with specific focus on data centers and major operational facilities.

PNC identifies and manages the security of its information assets according to these policies. These assets include data (in any form) and processing equipment, storage media, network component, device, etc., used to process, store, transmit or display information. Each asset has an owner responsible for implementing appropriate data security controls, authorizing access and monitoring the effectiveness of the controls.

PNC information assets are classified based on the confidentiality, integrity and availability characteristics of the data. Specific control requirements are established and implemented for each classification. These controls include both technology based controls and administrative controls designed to meet PNC risk management objectives.

The PNC Access Management Program provides electronic access to PNC data and data processing assets based on the access needed to perform job responsibilities by applying the following security/privacy principles:

PNC deploys industry standard tools for Data Leakage Prevention to protect confidential data from unauthorized transmission, storage and disclosure. Industry standard encryption tools are used to protect confidential data during transmission and at rest, where deemed necessary to meet PNC risk management objectives (e.g. laptop computers and mobile devices).

Physical and environmental controls are implemented to protect data centers and major operational facilities. These include controls over physical access to the facilities and restricted areas within the facilities, video surveillance of sensitive areas by on site security personnel, and alarm systems utilizing motion detection, infrared detection and electronic contacts for doors. PNC also meets industry standards and local codes for fire protection, water protection and electrical protection of our information assets.

Business continuity management provides a framework for building organizational resiliency and recovery capabilities that enable an effective response to business disruptions. Our program is designed to safeguard the interests of key stakeholders, reputation, brand and activities. In addition, business continuity management identifies potential threats to an organization and the impacts to business operations those threats might cause. The PNC Financial Services Group, Inc. (PNC) Business Continuity Program leads the organization’s business continuity activities, which include business recovery, disaster recovery and crisis management.

The guiding principles of the program are based on the priority to protect the health and safety of PNC employees, contractors, customers and third parties. PNC is committed to safeguarding the ongoing availability of PNC products and services through effective business continuity, disaster recovery and crisis management planning.

The major components of the Business Continuity Program include:

1. Business Impact Analysis (BIA) is performed annually and includes assessment and prioritization of business functions, identification of the customer, legal, regulatory, reputational, and financial impact of business disruptions, estimation of maximum allowable downtime and level of losses, and estimation of recovery time objectives, recovery point objectives, and recovery of the critical path.
2. Risk Assessments are conducted and documented to evaluate the BIA assumptions, analyze threats to PNC (including employees and facilities), its customers and markets, prioritize potential business disruptions, and provide a policies and procedures gap analysis. Risk assessments identify gaps between recovery demands and existing capabilities for technology, facilities, employees, and third parties.
3. Planning and Mitigation is focused on identifying, assessing, and reducing risk to an acceptable level through the development, implementation, and maintenance of a comprehensive business continuity program and related plans. Plans developed under the program are designed to be effective in minimizing service disruptions and financial loss and allows for flexibility to respond to unanticipated threat scenarios and changing internal conditions. The plans are specific regarding what conditions prompt crisis management implementation and the immediate steps to be taken during a disruptive event. Plans are disseminated and communicated to PNC employees.
4. Recovery Testing is an instrumental part of the methodology to validate the planning requirements identified within the business impact analysis and risk assessment. An enterprise‐wide testing and risk monitoring program executes annual testing sufficient to validate the viability of business continuity plans. The testing program includes but is not limited to:
   • Verifying defined roles and responsibilities;
   • Establishing the breadth, depth, and frequency of testing activities based on process criticality and/or changes to operating environments;
   • Ensuring testing of internal and external parties and supporting systems, processes and resources;
   • Demonstrating the ability of recovery arrangements to sustain the business until permanent operations are established;
   • Documenting and reporting test results;
   • An independent review by a third party; and
   • Identifying gaps as a result of testing and incorporating revisions to the testing program as necessary.
5. Risk Monitoring: Monitoring of activities and plans helps assure that the program is effective and remains viable. Specific business continuity components not aligned with the program are identified and remediation efforts implemented to address such gaps. Reports of risks and activities are produced with the objective of comprehensive and transparent reporting through the governance structure.
6. Third Party Continuity: Assessing the ability of third parties to respond to service disruptions and conducting recovery testing with third parties critical to business operations.
7. Awareness and Training: PNC provides business continuity planning awareness via internal meetings with lines of business, executive committee reviews, employee forums, awareness events, held at locations across the PNC footprint, and internal websites. Business continuity training is available to employees through PNC’s learning portal and includes general awareness training, manager web-based training, and reference guides for specific areas of focus within the business continuity program.
8. Reporting: Management reporting, which is an integrated part of PNC’s Business Continuity Program, is designed to summarize and highlight recovery and business resumption capabilities for specific businesses and services. It also provides a transparent overview among interdependent business activities. The reporting components are presented in aggregated management reports and provided to executive management and various committees.

The Business Continuity Program includes a crisis management capability, comprised of defined crisis teams, crisis plans and standardized processes. PNC’s Enterprise Crisis Management team maintains partnerships with a wide range of agencies, authorities and organizations to receive incident and event notification allowing for a quick and coordinated organizational response to crisis events. Additional steps, which also serve to mitigate and reduce impact to customer services, include: