5 unchanged sentences
The Company has designed this Cybersecurity program based in part on the National Institute of Standards and Technology Cybersecurity Framework (“NIST”).
−Removed: Use of the framework does not imply that the Company meets any particular technical standards, specifications, or requirements, but rather the NIST is used as a guide to help identify, assess, and manage cybersecurity risks relevant to the Company’s business.
−Removed: The Company’s Cybersecurity and Information Technology programs are led by our Chief Operations Officer, (“COO”) and Information Security Manger.
+Added: Use of the framework does not imply that the Company meets any particular technical standards, specifications, or requirements, but rather the framework is used as a guide to help identify, assess, and manage cybersecurity risks relevant to the Company’s business.
+Added: The Company’s Cybersecurity and Information Technology programs are led by our Chief Operations Officer, (“COO”) and Information Security Director.
The COO is responsible for the oversight and implementation of both programs.
−Removed: Additionally, the COO and the Information Security Manager meet with the Information Technology Steering Committee (“IT Steering Committee”) on a monthly basis or more frequently as necessary to discuss, among other things, cybersecurity matters.
+Added: Additionally, the COO and the Information Security Director meet with the Information Technology Steering Committee (“IT Steering Committee”) on a monthly basis or more frequently as necessary to discuss, among other things, cybersecurity matters.
The Cybersecurity and Information Technology programs are aligned to the Company’s business strategy.
3 unchanged sentences
• risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader information technology (“IT”) environment;
−Removed: • an incident response team principally responsible for managing cybersecurity risk assessment processes, security controls, and responses to cybersecurity incidents;
+Added: • information security and incident response teams principally responsible for managing cybersecurity processes, security controls, and responses to cybersecurity incidents;
• the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls;
1 unchanged sentence
• a cybersecurity and IT incident response plan that includes procedures for responding to cybersecurity incidents;
−Removed: • utilization of independent third parties to perform penetration testing of the Company’s environment;
+Added: • utilization of independent third-party tools and services to perform annual penetration testing and vulnerability scanning of the Company’s environment;
• utilization of a third party to monitor elements of our Cybersecurity and IT environment continuously;
−Removed: During the years ended December 31, 2024 and December 31, 2023, the Company had no cybersecurity incidents that had a material adverse effects on its business, financial condition or results of operations.
+Added: • utilization of a risk-based Third-Party Risk Management (“TPRM”) program that evaluates vendor cybersecurity controls and performs ongoing monitoring commensurate with risk as a result of third-party access to bank systems and data.
+Added: During the years ended December 31, 2025 and December 31, 2024, the Company had no cybersecurity incidents that had, or are reasonably likely to have, a material adverse effect on its business, financial condition or results of operations.
For a discussion of whether and how any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, refer to Item 1A.
Risk Factors – "Risks Related to Our Operations and Technology," which is incorporated by reference into this Item 1C.
−Removed: Cybersecurity Governance
−Removed: Management’s Role
−Removed: The Company’s management has created an Incident Response Team (“IRT”), that consists of the Chief Operations Officer, a network manager, an application delivery manager, an information security manager, the IT Steering Committee, the regulatory
CARTER BANKSHARES, INC.
AND SUBSIDIARIES
−Removed: risk management director and an internal auditor.
+Added: Cybersecurity Governance
+Added: Management’s Role
+Added: The Cybersecurity function is responsible for the design, implementation, and ongoing management of the organization’s cybersecurity program.
+Added: This includes policy development, security awareness and training, vulnerability and penetration testing oversight, risk assessment, control monitoring, incident response coordination, third-party risk oversight, and reporting cybersecurity risk to senior management and the Board.
+Added: The function is led by the Company’s Information Security Director, who reports to the Chief Operating Officer (COO).
+Added: The COO provides executive oversight of the program and is responsible for elevating significant cybersecurity matters to senior management and the Board of Directors, as appropriate.
Our COO holds multiple cybersecurity industry-recognized certifications and has gained extensive cybersecurity knowledge and skills through over 7 years of work experience on the IT security team at the Company.
−Removed: Our Information Security Manager, who also holds multiple cybersecurity industry-recognized certifications and is a member of the IT Steering Committee, has 20 years of experience working in IT and cybersecurity in various roles and industries throughout his career.
+Added: Our Information Security Director, who also holds multiple cybersecurity industry-recognized certifications and is a member of the IT Steering Committee, has over 20 years of experience working in IT and cybersecurity in various roles and industries throughout his career.
+Added: Cybersecurity topics are formally presented at monthly Information Technology Steering Committee (“ITSC”) meetings, where risk posture, vulnerability management, third-party risk management activities, cyber events or incidents, and other topics are reviewed.
+Added: When cybersecurity policy changes occur, the ITSC reviews and approves such policies as part of its governance responsibilities.
Additionally, leaders in the Company’s IT function receive periodic training and education on cybersecurity related topics.
−Removed: The IRT is governed by policies and procedures and their proactive responsibilities include implementing awareness programs for the overall cybersecurity risk management plan and for the supervision of vulnerability and penetration testing.
−Removed: The Company’s IRT serves as the central point for all cybersecurity incidents and reporting, including incidents that directly target associates, customers or the Company’s internal information systems and incidents originating from third parties.
−Removed: The IRT evaluates each incident in terms of its impact on the Company’s operations, ability to conduct business with customers, reputational risk to the Company, reduce legal risk and the speed and degree to which the incident has been contained.
+Added: The Company’s management has created an Incident Response Team (“IRT”), that consists of the COO, a network manager, an application delivery manager, The Information Security Director, the ITSC, the regulatory risk management director and an internal auditor.
+Added: The Company’s IRT serves as the central point for all cybersecurity incidents and technical response activities.
+Added: Regulatory notifications, customer communications, and reputational or legal risk determinations are managed by executive management, Legal, Compliance, and Communications, informed by information and details provided by the IRT.
The IRT is also responsible for assessing the nature and scope of the incident, and engaging third-party service providers where appropriate to support the Company through the resolution of the incident.
−Removed: The COO escalates incidents to the Company’s IT Steering Committee, who is responsible for cybersecurity risk oversight, and also reports to the Board on a monthly basis.
−Removed: Our information security team and members of IT monitor the effectiveness of preventative measures, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with law enforcement, regulators, external consultants, and reports produced by security tools we have deployed in our IT environment.
+Added: When required the COO escalates incidents to the Company’s ITSC, who is responsible for cybersecurity risk oversight, and also reports to the Board on a monthly basis.
+Added: The Company’s information security team and members of IT monitor the effectiveness of preventative measures, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include briefings with law enforcement, regulators, external consultants, and reports produced by security tools deployed in its IT environment.
Board of Director’s Role
5 unchanged sentences
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.