Item 1B. Unresolved Staff Comments
ITEM 1B. Unresolved Staff Comments
None.
ITEM 1C. Cybersecurity
Cybersecurity Risk Management and Strategy
The Company recognizes that risk is an intrinsic aspect of all areas of our business and activities. Effective risk management is vital to our success. A comprehensive risk management approach is fundamental to maintaining the trust of our customers and the efficacy of our financial services.
The Company’s Enterprise Risk Management (“ERM”) framework leverages the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) principles. This alignment is intended to bolster effective risk management practices that meet regulatory expectations. ERM considers all eight major risk categories including credit, market, liquidity, operational, compliance, reputation, legal, and strategic risk and further enhances the Company’s financial resiliency by integrating ERM with our capital and strategic planning processes. Cybersecurity is a major component of the broader operational risk category given the increase in risk due to the increased reliance on technology both for operating processes and delivery channels.
The Company is committed to safeguarding the confidentiality, integrity, and availability of our information assets, including in particular customer information, and information technology environment. The objective of our cybersecurity program is to minimize the potential and impact of cyber threats. Our comprehensive cybersecurity program is designed based upon the National Institute of Standards and Technology (“NIST”) cybersecurity framework and in accordance with applicable industry guidance inclusive of Federal Financial Institutions Examinations Council (“FFIEC”) Information Security program guidance and NYDFS guidance and requirements.
43
Table of Contents
Our cybersecurity governance framework includes documented policies, procedures, and controls designed to mitigate cybersecurity risk. We also perform regular risk assessments of our infrastructure, network architecture, and software/systems using current threat intelligence received from a variety of sources. We employ various preventative and detective controls to block, monitor, and alert for suspicious activity. Additionally, we engage third-party experts to perform periodic internal and external assessments, including penetration testing and vulnerability scanning. We also maintain an ongoing education and training program designed to increase employee awareness and gauge risks relative to the human element. Moreover, we maintain a third-party risk management program designed to identify, assess, and mitigate risks, inclusive of cybersecurity risk, associated with third-party service providers and the Company’s supply chain vendors. Lastly, we engage third-party audit firms to periodically assess our IT general controls and information security.
We also maintain an Incident Response Plan that provides a structured framework for addressing potential or actual cybersecurity incidents. The procedures and detections/prevention mechanisms included in the Incident Response Plan are continuously refined to address evolving threats and alerts. The Incident Response Plan provides for the timely notification, escalation, and reporting of cybersecurity incidents to the Bank’s Operational Risk Management Committee, Enterprise Risk Management Committee, and the Board of Directors and/or the duly designated ERM Committee of the Board of Directors. It also includes for the timely notification to regulatory agencies, including but not limited to the FDIC, DFS, FRB and SEC as required or deemed appropriate. We also undertake periodic simulations and tabletop exercises to test our Incident Response Plan and ensure business resiliency and proper incident response management.
Cybersecurity Governance
The Bank has outsourced the Information Security Officer (“ISO”) role via a virtual Chief Information Security Officer (“vCISO”) relationship. The vCISO assists management to assess, operate, and remediate information security issues and gaps. The vCISO provides security leadership and advisory services in a consultative manner that effectively leads the Bank through ongoing information security assessment and improvement activities.
The Bank has an Information Security Manager (“ISM”), who is an active member of the following management-level committees: Incident Response Committee, IT Steering Committee, Change Control Committee, Product Management Committee, Project Management Committee, and Operational Risk Management Committee (“ORMC”). The ISM reports to the ORMC on a quarterly basis, or more frequently if needed, regarding the effectiveness and status of the cybersecurity program, material cybersecurity risks and key risk indicators, and material cybersecurity trends and developments.
The Bank has a team of Information Security and Third-Party Risk Management Analysts who are responsible for the daily execution of our Information Security, Business Continuity, and Vendor Risk Management Programs.
The vCISO reports to the Company’s Board Enterprise Risk Management Committee on a quarterly basis, or more frequently if needed. The vCISO reports on the overall cybersecurity program, material cybersecurity risks and key risk indicators, and material cybersecurity trends and developments. The vCISO also provides an annual Information Security report to the Company’s Board Enterprise Risk Management Committee and executive leadership team on the overall cybersecurity program, including material risks, key risk indicators, and emerging trends .
The ultimate responsibility, among management, for effective risk management, including cybersecurity risk, resides with the Chief Executive Officer (“CEO”). The Bank’s CEO and CISO (or their equivalent) annually certify compliance to the DFS as required under DFS regulations.
44
Table of Contents
Material Cybersecurity Risks, Threats, and Incidents
Our cybersecurity program has been designed to mitigate risks from cyber-attacks. However, even with a strong internal control environment designed to mitigate risks, we are keenly aware that risks cannot be entirely eliminated. Notwithstanding our cybersecurity program’s effectiveness, the threat posed by cyber-attacks remains substantial. Additionally, we maintain cybersecurity insurance designed to further reduce residual risk. Nevertheless, due to the continuously shifting and evolving threat landscape and global geopolitical events, a portion of cyber risk remains inherently beyond full mitigation.
While we have experienced cybersecurity incidents in the past, we do not believe any of these incidents have materially affected or are reasonably likely to materially affect the Company or its operations and financial condition .