Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
Coastal recognizes the critical importance of identifying, assessing and managing material risks from information security threats. One key way that Coastal mitigates information security threats is through the Company’s information security program (the “Information Security Program”). Cybersecurity is an integral subset of information security and the
50
Table of Contents
Information Security Program is designed to protect the Company from cybersecurity attacks, breaches, incidents and resulting consequences.
As part of the Information Security Program, the Company has implemented preventative controls to minimize data loss, exposure and misuse. These controls are designed to be implemented before a threat event to avoid the likelihood and potential impact of inadvertent or intentional misuse, improper disclosure, damage or loss. In addition, the Information Security Program includes internal and external penetration testing, regular vulnerability assessments, detailed vulnerability management, data loss prevention controls, file access, controls, data integrity monitoring and reporting, and threat intelligence. The Information Security Program is coordinated and primarily executed by our information security, technology, and operations personnel. The IT department is responsible for the oversight of all managed systems and implements and maintains appropriate controls to protect the confidentiality, integrity and availability of computerized data and information resources. Coastal applies a layered defense strategy for protecting information systems and customer information, including the implementation of zero-trust principles, which require authenticated, authorized, and validated users and devices to access applications and data. Security logs are correlated and monitored by an internal security team as well as an augmented third-party Security Operation Center. Network vulnerability scans are conducted daily.
Coastal engages third party auditors and consultants in connection with the Information Security Program, including conducting external penetration testing, independent audits and risk assessments. Coastal also utilizes third party service providers in the ordinary course of business to provide services to customers and partners. These third-party service providers may store or process confidential information and personally identifiable information related to our customers or on behalf of our partners to perform those services for which they were engaged. Coastal has implemented a vendor management program to help ensure third-party relationships are effectively managed . Under this program, we have established risk-focused controls and processes that are designed to monitor our vendors’ compliance with relevant laws, regulations, and industry standards, such as data privacy regulations and anti-corruption laws, as well as relevant contractual obligations.
Executive Management is responsible for managing the Information Security Program’s operations for identifying, assessing and mitigating external and internal risks to the security, confidentiality and integrity of nonpublic information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. Coastal’s Chief Information Security Officer (“CISO”) is designated by the Board and is responsible for implementing and monitoring the Information Security Program. The CISO is an Executive Vice President who joined Coastal in this role in May 2025 with a background in security leadership at both fintech companies and large enterprises. Furthermore, the Technology Committee is a standing committee of the Board that has general responsibility to oversee the Bank’s strategies related to technology, innovation, data privacy, information security, cybersecurity and third-party technology. The CISO provides Information Security Program updates and current Key Risk and Performance Indicator (KRI/KPI) metrics to both the Technology Committee and the Board throughout the year, as well as an Annual Information Security report pursuant to the requirements of the Gramm-Leach-Bliley Act (GLBA) and other related frameworks.
The Board exercises oversight over the Information Security Program and reviews and approves the Information Security Program at least annually. Cybersecurity risk management is also incorporated into Coastal’s overall enterprise risk management framework, which is updated on an annual basis and subject to oversight by the Management Risk Committee and the Board.
Although Coastal has not, as of the date of this Annual Report on Form 10-K, experienced a cybersecurity threat or incident that materially affected Coastal’s business strategy, results of operations, or financial condition, there can be no guarantee that Coastal will not experience such an incident in the future. For a discussion regarding risks from cybersecurity threats, see “Item 1A. Risk Factors,” including the risk factors titled “— We are subject to laws regarding the privacy, information security and protection of personal information and any violation of these laws or another incident involving personal, confidential or proprietary information of individuals could damage our reputation and otherwise adversely affect our business, financial condition and results of operations” and “— We are dependent on our information technology and telecommunications systems and third-party service providers; systems failures, interruptions, security breaches and cybersecurity threats could have an adverse effect on our business, financial condition and results of operations.” As noted above, we are a regulated financial institution and are subject to financial privacy laws and to oversight by federal banking agencies. For additional information on these laws and oversight, see “Item 1. Business—Regulation and Supervision.”
51
Table of Contents