Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments.
None.
Item 1C. Cybersecurity.
The Company recognizes that the security of our operations is critical to protecting our customers and maintaining the reputation of the Company. Management is committed to managing Information Security ("IS") risk, which includes cybersecurity, that may impact the Company. The Enterprise Risk Committee ("ERC") of the Board of Directors provides oversight of the Company’s written Information Security Management and Information Technology Governance Programs (the "Programs"). Through the Programs, the Company has established policies, processes, controls, and systems designed to identify, assess, measure, manage, monitor, and report risks related to cybersecurity and help prevent or limit the effect of possible cybersecurity threats and attacks. As cybersecurity threats continue to evolve, the Company expects to continue to monitor and enhance the current controls and systems in place to detect and prevent cybersecurity attacks and to remediate discovered vulnerabilities.
The Company’s Information Security Officer (“ISO”) is responsible for the design and execution of the Information Security Management Program and the information and cyber-security aspects of the Information Technology Governance Program. The ISO works in concert with members of the Information Technology (“IT”) Department, including the Bank’s Chief Information Officer (“CIO”), to ensure the execution of the Programs. The aforementioned individuals meet with management on a monthly basis through an IT Steering Committee in which management assesses IS and IT risk. Additionally, the ISO provides the ERC with regular reports on the status and effectiveness of the Pro grams and risk management activities, as well as cyber and IS issues that may affect the Company. The Board of Directors receives an Annual Report on Information Security which highlights industry-wide trends, threats, and actions taken by the Company to maintain preparedness.
The ISO has served various roles involving anti-money laundering, law enforcement, security, and information technology for over 8 years. The ISO holds an undergraduate degree in Legal Studies and master's degree in Criminal Justice and Criminology. The ISO reports to the SVP Controller as well as the Chairperson of the ERC. The CIO has served various roles in audit, information risk, information technology, and information security in multiple industries for over 13 years. The CIO holds an undergraduate degree in Management Information Systems and has attained the ISACA Certification in Certified Information Systems Auditor ("CISA"). The CIO reports to the Chief Financial Officer ("CFO").
The Company utilizes the following guidelines and frameworks to develop and maintain the Information Security Management Program: Federal Financial Institutions Examination Council ("FFIEC") Information IT Examination Handbooks, Center for Internet Security Critical Security Controls, National Institute of Standards and Technology Special Publication 800 Series, National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"), New York State Department of Financial Services 23 NYCRR Part 500, 12 CFR 364 - Appendix B — Interagency Guidelines
35
Establishing Information Security Standards Gramm-Leach-Bliley Act ("GLBA"). In addition, the Company maintains membership with industry cybersecurity groups to stay up-to-date with threats and threat information.
The Information Security Management Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring, and a Security Operations Center that provides full time support and additional operational measures to monitor and respond to data breaches and cyberattacks. The Information Security Management Program and Information Technology Governance programs also define a comprehensive set of policies, procedures and controls that govern the actions of the Information Security and Information Technology departments of the Company. The Company leverages regular assessments to identify current and potential threats and vulnerabilities within the Company’s environment. Technical vulnerabilities are identified through regular automated vulnerability scans and periodic vulnerability and penetration testing performed by independent third parties. Non-technical vulnerabilities are identified through the IT and IS Assurance Program by conducting regular process and procedural reviews as well as risk assessments. The Company uses the NIST CSF to help identify cybersecurity risks and determine our cybersecurity preparedness. The Company’s information security and cybersecurity risk appetite statements define the levels of risk the Company is willing to accept and guide the risk management decisions of the Company. The risk appetite statements are approved by the Board of Directors annually.
The Company has an Incident Response Plan to help reduce the risks related to security incidents by providing guidelines on responding to incidents; focusing on a roadmap for coordinating personnel, policies, and procedures to ensure incidents are detected, analyzed, and handled appropriately.
The Company also recognizes the risks associated with the use of third party providers and maintains a Third Party Management Program that is responsible for the oversight of outsourced services. This enables the Company to identify risks related to third parties through an inherent risk assessment and a due diligence review process designed to ensure third parties are in compliance with the Company’s risk and information security expectations.
The Company’s Security Awareness Program ("SAP") provides annual, mandatory training for personnel on information security to prepare personnel with the knowledge of how to properly use and protect Company resources from internal and external threats. The SAP also conducts regular phishing assessments and targets new hires and other groups with specific training related to their job activities or risk levels. Additionally, the SAP also communicates information security policies, standards, and practices to personnel and requires annual review and acknowledgement of the policies.
For the year ended December 31, 2025, the Company has not identified any specific risk from a cybersecurity threat that has materially affected, or is reasonable likely to affect, the Company’s business strategy, results of operation, or financial condition, other than those described in Item 1A. Risk Factors - Risks Related to Operations.
36
Item 2. P roperties.
We conduct our business through our corporate headquarters, administrative offices, and ten branch offices. At December 31, 2025, the net book value of our buildings and premises was $6.6 million and the net book value of the computer equipment and other furniture and fixtures, and equipment at our offices totaled $454,000. Our buildings, premises, and equipment are in good working order and are sufficient to meet our needs. For more information, see Note 6 and Note 9 in the notes to our audited consolidated financial statements beginning on page F -1 of this report.
Leased or
Original
Location
Owned
Date Acquired
Corporate Headquarters
31 East Fourth Street
Dunkirk, NY 14048
Owned
2003
Branch Offices:
Chautauqua County branches
128 East Fourth Street
Dunkirk, NY 14048
Owned
1926
30 East Main Street
Fredonia, NY 14063
Owned
1996
1 Green Avenue, WE
Jamestown, NY 14701
Owned/Leased (1)
1996
106 East Main Street
Westfield, NY 14787
Owned
1998
Erie County branches
5751 Transit Road
East Amherst, NY 14051
Owned
2003
3111 Union Road
Orchard Park, NY 14127
Owned
2003
59 Main Street
Hamburg, NY 14075
Leased (2)
2005
3438 Delaware Avenue
Kenmore, NY 14217
Owned
2008
570 Dick Road
Depew, NY 14043
Leased (3)
2009
4950 Main Street
Snyder, NY 14226
Owned
2012
Administrative Offices:
125 East Fourth Street
Dunkirk, NY 14048
Owned
1995
123 East Fourth Street
Dunkirk, NY 14048
Owned
2001
115 East Fourth Street
Jamestown, NY 14701
Owned
1997
(1) The building is owned. The land is leased. The lease expires in 2030, and has two, five-year extension terms that can be executed at our option.
(2) The lease expires in 2028 and has two, five-year extension terms that can be executed at our option.
(3) The lease expires in 2029.