Item 1B. Unresolved Staff Comments
ITEM 1B. UNRESOLVED STAFF COMMENTS
None.
ITEM 1C. CYBERSECURITY
As a publicly-traded financial institution, we are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations, and reputation, including cyber-attacks against us or our critical third-party service providers. Cyber-attackers may attempt to gain unauthorized access to our systems for purposes such as misappropriation of Company assets, accessing confidential or sensitive customer non-public information, corrupting or destroying data, disrupting operations, or making ransom demands.
Cybersecurity threats continue to evolve in both frequency and sophistication as financial institutions increasingly rely on digital channels, remote connectivity, cloud-based services, and third-party technology providers. While we devote significant resources to managing these risks, no cybersecurity controls or procedures can provide absolute assurance that a cybersecurity incident will not occur.
Our information security program is designed to preserve the confidentiality, integrity, and availability of Company confidential information, customer non-public personal information, and other data maintained on our systems, as well as to secure our interfaces with critical third-party service providers. The program is risk-based and tailored to the size, complexity, and risk profile of the Company and is integrated into the Company’s broader enterprise risk management framework.
The cybersecurity program includes administrative, technical, and physical safeguards intended to identify, assess, manage, and monitor cybersecurity risks across the organization. Risk assessments are conducted periodically and in connection with material technology changes, new products, and third-party relationships. Identified risks are prioritized and addressed through remediation activities, risk acceptance, or other mitigation strategies consistent with the Company’s risk appetite.
Additionally, the Company continually works to align its policies and practices with industry-accepted information security practices as provided by the Cyber Risk Institute, Payment Card Industry Data Security Standards, and other applicable standards, laws, and regulations.
Cybersecurity risk considerations are incorporated into strategic planning, technology initiatives, and day-to-day business operations. The Company maintains written policies, standards, and procedures designed to address evolving cybersecurity threats and regulatory expectations. These policies define roles and responsibilities for employees and contractors and are supported by ongoing training and awareness activities.
The Company utilizes a combination of internal resources and external service providers to support elements of its cybersecurity program, including security monitoring, threat intelligence, vulnerability management, penetration testing, social engineering testing, and incident response preparedness. These activities are designed to enhance the Company’s ability to prevent, detect, and respond to cybersecurity threats in a timely manner.
T he Board of Directors is ultimately responsible for the oversight of cybersecurity risk management. The Board, primarily through its Risk Committee , receives periodic updates from management regarding the status and effectiveness of the Company’s information security program, key risk indicators, emerging cybersecurity threats, and significant risk management initiatives. The Board also receives cybersecurity education to support informed oversight.
Management is responsible for implementing and maintaining the Company’s cybersecurity risk management program. Cybersecurity oversight is conducted through established management
36
committees comprised of senior executives with risk management, technology, and information security expertise. These committees provide direction, review program performance and risk metrics, approve key initiatives, and escalate significant matters to senior management and the Board, as appropriate.
The Company employs a Chief Information Security Officer who is responsible for administering and executing the Company’s written information security program and coordinating cybersecurity risk management activities across the organization. The Chief Information Security Officer works closely with other members of management to align cybersecurity practices with business objectives and regulatory requirements.
The Company maintains a cybersecurity incident response program designed to guide the assessment of and response to cybersecurity incidents. The program includes defined procedures for incident identification, investigation, documentation, escalation, and communication. Incident response plans are periodically reviewed and tested to promote preparedness and coordination across the organization.
In the event of a significant cybersecurity incident, senior management and the Board are informed in accordance with established escalation protocols. The Company also evaluates whether incidents require notification to customers, regulators, or other stakeholders, as applicable, based on the nature and severity of the incident and applicable legal and regulatory requirements.
The Company manages cybersecurity risks associated with third-party service providers through a third-party risk management program that includes risk-based due diligence, contractual security requirements, and ongoing monitoring. The Company seeks to obtain appropriate assurances regarding third-party security controls and incident notification obligations and monitors third-party performance throughout the lifecycle of the relationship.
While the Company believes that its cybersecurity risk management practices are appropriate for its business and risk profile, cybersecurity threats remain a persistent and evolving risk. The increasing reliance on technology, interconnected systems, and third-party providers heightens the potential impact of a cybersecurity incident.
As of the date of this filing, the Company is not aware of any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations, or financial condition. For additional discussion of cybersecurity-related risks, see Item 1A. “Risk Factors.”
37
Text extracted from the filing as submitted to EDGAR. Formatting, tables and exhibits are simplified for reading; the original document is authoritative for anything you rely on.