Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
Cybersecurity Risk Management and Strategy
Avidbank maintains an information security and cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of its information systems and client information. The Bank identifies, assesses, and manages cybersecurity risks as part of its broader enterprise risk management processes, consistent with applicable regulatory guidance and industry practices.
The Bank’s cybersecurity program incorporates a defense‑in‑depth approach and is informed by recognized cybersecurity frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (“NIST CSF”), as well as guidance issued by banking regulators. The program includes administrative, technical, and physical safeguards intended to prevent, detect, and respond to cybersecurity threats.
Key elements of Avidbank’s cybersecurity program include:
• Risk Assessment and Management : Ongoing identification and evaluation of cybersecurity threats, vulnerabilities, and risks, informed by threat intelligence, regulatory developments, and internal assessments.
• Security Monitoring and Incident Response : Continuous monitoring of systems and networks, supported by internal resources and third ‑party service providers, and an incident response framework designed to enable timely identification, escalation, containment, and remediation of cybersecurity incidents.
• Access Controls and Data Protection : Use of access controls, including multi‑factor authentication, encryption, and role‑based access, to protect sensitive client and Bank information.
• Testing and Resilience : Periodic vulnerability assessments, penetration testing, and social engineering testing performed by internal teams and independent third parties, with remediation or mitigation of identified issues based on risk.
• Training and Awareness : Ongoing cybersecurity awareness and training for employees to reinforce responsibilities related to safeguarding client and Bank information.
While Avidbank maintains processes and controls designed to reduce cybersecurity risk, no system is completely immune from cybersecurity threats.
Third‑Party Risk Management
Cybersecurity risks associated with third‑party vendors and service providers are addressed through Avidbank’s vendor risk management program. The Bank conducts due diligence and risk assessments of vendors that may access Bank systems or client information. Critical and higher‑risk vendors are subject to enhanced review and periodic reassessment, including evaluation of security controls, business continuity capabilities, and independent assurance reports, as applicable. Contractual requirements are used, where appropriate, to address information security and data protection obligations.
-
53 -
Table of Contents
Governance and Oversight
Avidbank’s Board of Directors oversees cybersecurity risk as part of its overall risk governance responsibilities. Management provides regular updates on cybersecurity matters, including risk assessments, testing activities, significant initiatives, and emerging threats.
Cybersecurity governance is supported by the Bank’s Information Technology Steering Committee (“ITSC”), which includes executive and senior‑level management representation. The ITSC assists management in overseeing information technology and cybersecurity risks, reviewing security posture, monitoring incidents and remediation efforts, and facilitating escalation of significant issues, as appropriate.
The Bank’s Chief Technology Officer (“CTO”) and Information Security Officer (“ISO”) are responsible for the day‑to‑day management and execution of the cybersecurity program. These roles work collaboratively to implement security controls, manage cybersecurity risks, coordinate incident response activities, and report relevant cybersecurity matters to executive management, the ITSC, and the Board.
Cybersecurity Incidents
As of the date of this Annual Report on Form 10‑K, Avidbank has not experienced any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Bank’s business strategy, results of operations, or financial condition. However, cybersecurity threats continue to evolve, and the Bank cannot provide assurance that future incidents will not occur.
For additional information regarding cybersecurity risks, see Item 1A. “Risk Factors” in this Annual Report on Form 10‑K.