What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2024-03-14 compared with 2023-03-17 · 130 added, 12 removed, 117 unchanged (55% of the section changed)

STAFF COMMENTS

CYBERSECURITY

We rely extensively on

various information systems and other electronic resources to operate our business.

nearly all of our customers, service providers and other business partners on whom

we depend, including the providers of

our online banking, mobile banking and accounting systems, use their own electronic information

systems can be compromised, including by employees, customers and other individuals

who are authorized to use them,

and bad actors using sophisticated and a constantly evolving set of software, tools

and strategies to do so.

The threats are

domestic and international and range from small to large, including state

sponsored, terrorist and criminal organizations

with substantial funds, and technical and other resources

As a bank, we and our vendors, service providers and customers may be attractive targets,

and we confront continuous

cybersecurity threats.

Insurance to fully cover these risks is unavailable in sufficient

amounts at reasonable costs.

believe the more effective approach is taking active measures to

detect, deter and reduce cybersecurity threats, and be

prepared to address and remediate any breaches and prevent similar breaches in the

See “Risks Related to

Information Security and Business Interruption” section of the Risk Factors included

in Item 1A of this Form 10-K for

Accordingly, we have devoted

significant resources to assessing, identifying and managing risks associated

cybersecurity threats, including:

Implementing an Information Security Program that establishes policies and

procedures for security

operations and governance;

Establishing an IT Steering Committee of the Board that is responsible for security administration,

conducting regular assessments of our information systems, existing controls, vulnerabilities

and potential

improvements;

Implementing layers of controls and not allowing excessive reliance on any single control;

Employing a variety of preventative and detective tools designed to monitor,

block and provide alerts

regarding suspicious activity;

Continuously evaluating tools that can detect and help respond to cybersecurity threats

in real-time;

Leveraging people, processes and technology to manage and maintain cybersecurity controls;

Maintaining a vendor management program with periodic review processes, and

a third-party risk

management program designed to identify, assess and manage risks associated

with external service providers;

Monitoring our systems and related software and programming periodically to update

programing, including updating data protection elements,

and requiring that our service providers also engage

in similar programs that are reasonably designed to deter cybersecurity breaches;

Performing initial and ongoing due diligence with respect to our third-party service

providers, including their

cybersecurity practices and safeguards, and service levels based on the risk they pose to the Bank;

Engaging third-party cybersecurity consultants, who conduct periodic

penetration testing, vulnerability

assessments and other procedures to identify potential weaknesses in our systems and

Conducting periodic cybersecurity training for our employees and the Company’s

board of directors.

Our Information Security Program is a key part of our overall risk management system,

which is administered by our IT

Steering Committee and evaluated by our IT Steering Committee and chief risk officer.

The program includes

administrative, technical and physical safeguards to help protect the security and confidentiality

and availability of

customer records and information.

From time-to-time, we have identified cybersecurity threats that require us to

make changes to our processes, equipment

and to implement additional safeguards.

While none of these identified threats or incidents

have materially affected us, it is

possible that threats and incidents we identify in the future could have a material adverse effect

on our business strategy,

customer service, data privacy and security,

continuity of service and reputation, and our results of operations and financial

The Company’s Chief Technology

Officer is responsible for the day-to-day management of

cybersecurity risks we face and

oversees the IT Steering Committee, which is chaired by a director of the Company’s

The IT Steering Committee

oversees the information security assessment, development of policies, standards

and procedures, testing, training and

security report processes.

The IT Steering Committee is comprised of directors and officers

with the appropriate expertise

and authority to oversee the Information Security Program.

Our Chief Technology Officer,

along with the information technology department, is accountable for managing our

enterprise information security and delivering our information security program.

department, as a whole, consists of

information security professionals with varying degrees of education and experience.

The Chief Technology Officer

subject to professional education and certification requirements.

In particular,

our Chief Technology

Officer, who is also

designated as our Information Security Officer,

has relevant expertise in the areas of information security and cybersecurity

risk management.

In addition, the Company’s Board,

both as a whole and through its IT Steering Committee is responsible for the oversight

of risk management, including cybersecurity risks.

In that role, the Company’s

Board and the IT Steering Committee, with

support from the Company’s management and third

party cybersecurity advisors, are responsible for ensuring that the risk

management processes designed and implemented by management are adequate

and functioning as designed.

reviews and approves an information security program, vendor management policy (incl

uding third-party service

providers), acceptable use policy,

incident response policy and business continuity planning policy on an annual basis.

the aforementioned policies are developed and implemented by Company management.

To carry out their duties,

receives updates at least quarterly from the Chief Technology

Officer regarding cybersecurity risks and the Company’s

efforts to prevent, detect, mitigate and remediate any cybersecurity incidents.

DESCRIPTION OF PROPERTY

5 unchanged sentences

constructed AuburnBank Center,

which was completed in May 2022 and held its grand opening in June 2022.

which was completed in May 2022 and had its grand opening in June 2022.

AuburnBank Center has approximately 90,000 square feet of space.

42 unchanged sentences

In November 2002, the Bank opened a loan production office

in Phenix City, Alabama, about 35

miles south of Auburn,

In November 2022, the Bank renewed its lease for another year.

in a leased space in Phenix City,

Alabama, about 35 miles

south of Auburn, Alabama.

In November 2022, the Bank renewed its lease for another

In February 2009, the Bank opened a branch located on Bent Creek Road in Auburn,

18 unchanged sentences

originally opened in September 2004.

In February 2015, the Bank relocated its Auburn Kroger branch to a new location within the

Corner Village Shopping

In February 2015, the Bank relocated its Auburn Kroger branch to a new location

within the Corner Village Shopping

Center, in Auburn, Alabama.

6 unchanged sentences

Prior to relocation, the Bank’s

Kroger branch was located in the Kroger supermarket in the same shopping

center since August 1988.

Kroger branch was located in the Kroger supermarket in the same shopping center

since August 1988.

The current Corner

1 unchanged sentence

full line of the Bank’s deposit and other services including

except safe deposit boxes.

but does not maintain safe

deposit boxes.

In September 2015, the Bank relocated its Auburn Wal

26 unchanged sentences

In addition to the eight ATMs

at various branch locations, mentioned above, the Bank also has five

at various branch locations, mentioned above, the Bank also has four

various locations within our primary service area.

4 unchanged sentences

newly developed AuburnBank Center in June 2022.

The Company has entered into a sublease agreement with a tenant for

three years with an option to renew for three additional years.

The Company entered into a three year sublease agreement, during

2022, with a tenant, which has an option to renew that lease for three additional years.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments