OP Bancorp 10-K

Item 1B. Unresolved Staff Comments. None. 24 Item 1C. Cybersecurity. Risk Management and Strategy We believe our cybersecurity program is sufficient to protect our operating systems and our databases, including those containing client information and employee information, from known and reasonably expected risks, while promoting the timely detection of, and defense against, cyberattacks and other unauthorized access to our information technology (“IT”) systems. We maintain up-to-date information security and monitoring controls designed to mitigates cybersecurity risks while optimizing system utility; however, cyberattacks are becoming increasingly common, sophisticated, and destructive, and several large financial institutions have been successfully targeted in recent years, resulting in data loss, service disruptions, and reputational harms. To mitigate these risks, our Information Security Officer ("ISO") has primary responsibility for assessing, monitoring, and managing cybersecurity risks, including the detection of and response to identified threats and incidents, and reports regularly to our Board of Directors while overseeing policies and procedures intended to guard against, detect, and respond to potential breaches of our IT systems. The ISO has extensive cybersecurity program management experience, holds advanced academic and professional credentials, including a doctoral degree in information technology and cybersecurity and the Certified Information Systems Security Professional ("CISSP") certifications, and works jointly with the Chief Risk Officer, who chairs the Management Compliance and Risk Committee and has more than 20 years of compliance and risk management experience, to manage cybersecurity incident disclosures and related communication . Managing Material Risks & Integrated Overall Risk Management We have integrated cybersecurity risk management strategically throughout our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our procedures and security program are the guiding policies over our cybersecurity risk management. Additionally, our IT team uses the best currently available tools to help protect against cybercriminals. We leverage the latest encryption practices and cyber technologies on our systems, devices, and third-party connections and further review vendor encryption to ensure proper information security safeguards are maintained. Our employees are responsible for complying with our cybersecurity standards and complete training to understand the behaviors and technical requirements necessary to keep information secure. Engaging Third Parties for Risk Management We recognize the complexity and evolving nature of cybersecurity threats, which is why we engage a range of external experts, including cybersecurity consultants, in evaluating and testing our risk management systems. Our IT security team partners with third-parties to perform annual penetration testing, vulnerability scanning, and monitoring of any potentially suspicious activity across the Company. Oversight of Third-party Risk We also maintain a third party risk management program that applies to all third-party vendor relationships. Our Board of Directors has the ultimate responsibility for providing oversight for third-party risk management and holding management accountable. The Board provides clear guidance to regarding strategic goals and acceptable risk appetite with respect to third-party relationships. The Board reviews this policy on at least an annual basis to assure that we implement procedures and practices have been established by management. Our Chief Risk Officer is responsible for developing and implementing third-party risk management policies, procedures, and practices, commensurate with the Company’s strategic goals, risk appetite and the level of risk and complexity of its third-party relationships, and any potential changes in, this policy. The Company’s internal audit also assesses and reports to the Board concerning the appropriate frequency and scope of audits to examine the effectiveness of our third-party risk management program. The Company recognizes that not all third-party relationships present the same level of risk, and therefore not all third-party relationships require the same level, degree or type of oversight or risk management. As part of its risk management program, management analyzes the specific risks associated with each third-party relationship, including but not limited to, cybersecurity and information security related risks. 25 Governance The Board recognizes the importance of managing risks associated with cybersecurity threats. The Board has established robust oversight procedures to promote effective governance in managing cybersecurity risks because of the significance of these threats to our operational integrity and shareholder confidence. Board of Directors Oversight The Board Risk and Compliance Committee ("BRCC") is central to the Board’s oversight of cybersecurity risks. The BRCC currently oversees various risk areas such as regulatory compliance, CRA, BSA/AMLA, enterprise risk management, cybersecurity, technology, and third-party risk management. The committee ensures that the Board maintains appropriate expertise to assure the appropriate management of cybersecurity risk. The BRCC reports periodically to the Board on the effectiveness of cybersecurity risk management processes and cybersecurity risk trends. The Board also receives specific reports from senior management with oversight responsibility for cybersecurity risks within the Company. These reports include risk assessments of cybersecurity and related risks, as well as the Company’s vulnerability to those risks. The BRCC reviews an annual evaluation of the Company’s cybersecurity posture and the effectiveness of its risk management strategies, identifying areas for improvement and ensuring the cybersecurity efforts are integrated with the overall risk management framework. Management’s Role in Managing Risk The ISO plays a pivotal role in informing the BRCC on cybersecurity risks. Jointly with the Chief Risk Officer, the ISO reports quarterly to the BRCC on a range of topics, including: • Current cybersecurity landscape and risks; • Status of ongoing cybersecurity incidents, threats and strategies; • Internal and external test result and remediation efforts; • Enforcement of ongoing awareness training on information security; • Cybersecurity incident reporting and post-incident reviews; and • Compliance with regulatory requirements and evolving industry trends. The ISO reports to the BRCC on the status and impact of any information security related developments and strategic initiatives, and depending on the severity of the situation, directly to the Board of Directors. In addition to regular meetings, the BRCC, the ISO, Chief Risk Officer, Chief Technology Officer, and Chief Executive Officer maintain an ongoing dialogue regarding emerging or potential cybersecurity risks that we face, particularly as a financial institution. The Company’s Management Risk and Compliance Committee also reports directly to the BRCC regarding our risk management initiatives. The BRCC also receives quarterly reports from the Executive IT Committee and IT department in order to say informed on all aspects of cybersecurity risk affecting the Company. Monitoring Cybersecurity Incidents The Company utilizes various industry-leading systems to provide 24/7 threat detection and response capability, many of which provide proactive measures to shut threats down before they can harm the organization. Additionally, the Company’s incident response team periodically performs proactive measures, searching for potential indicators of threats, compromise, and bad actors on our network. Endpoint and network detection tools alert IT staff of security events that warrant further analysis. The ISO is kept abreast of all active investigations. If an incident is identified, we attempt to contain the threat is immediately, such as if systems could be taken offline to stop the spread of an attack. Eradication of an attacker’s artifacts, such as user accounts and malicious code, would then be performed. The Company maintains Business Continuity and Disaster Recovery plans, processes, and technology to restore systems affected by a cybersecurity incident. The ISO may determine that an incident has the potential to be materially relevant and would escalate that determination to the executive management, including Chief Executive Officer, Chief Risk Officer, Chief Technology Officer, Chief Financial Officer, and other leaders and advisors of the Company. In addition, we maintain insurance that we believe is customary against certain insurable cybersecurity risks. However, certain 26 aspects of cybersecurity risks are not insurable, and the availability, extent, and cost of coverage may limit our recourse to these sources of risk mitigation. Item 2. Properties. Our principal office is located at 1000 Wilshire Blvd., Suite 500, Los Angeles, California 90017. The Company operates twelve leased full-service branches, five leased loan production offices, and one leased administrative office, and maintains its headquarters at a leased location. We believe our current facilities are adequate to support our operational needs. Item 3. Legal Proceedings. In the normal course of business, we are subject to legal proceedings or claims. Management has reviewed all legal claims against us and possible loss contingencies, and does not expect the amounts to be material to any of the Consolidated Financial Statements. Item 4. Mine Safety Disclosures. Not applicable. 27 PART II