Unresolved Staff Comments
+Added: 2025 FORM 10-K 18
Cybersecurity
−Removed: Cyber/information security is a significant and integrated component of the Company’s risk management strategy.
+Added: Cyber/information security is an important component of the Company’s enterprise risk management framework.
As an insured depository institution, threats to information security are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data.
1 unchanged sentence
Cybersecurity Risk Management and Strategy:
−Removed: The Bank maintains comprehensive policies, procedures, internal controls and practices with respect to cyber/information security, including:
−Removed: • Information Security Policy and Risk Management.
−Removed: The Bank maintains an Information Security Policy reviewed and updated as needed, and at least annually by its Board of Directors.
−Removed: • Information Technology & Information Security Audits.
−Removed: The Bank conducts independent external and internal audits of internal controls relating to information technology and information security in accordance with standards established by the Federal Financial Institutions Examination Council (FFIEC).
−Removed: • Information Security Management.
−Removed: To prepare and respond to incidents, the Bank maintains implemented multi-layered cybersecurity protocols, integrating people, technology, and processes as part of the Bank’s Information Security Program.
−Removed: The Information Security Program is governed by various information security and cybersecurity, systems development, change control, disaster recovery/business continuity, third-party risk management and physical asset classification and control policies.
−Removed: The Information Security Program identifies data sources, threats and vulnerabilities, deploys current information security technologies and ensures awareness, accountability, and oversight for data protection throughout the Bank and with trusted third parties to ensure that data is protected and able to be recovered in the event of a breach or failure (technical or other disaster).
−Removed: The Company engages qualified third-party vendors, consultants and independent auditors to, among other things, conduct network penetration tests and perform cyber/information security audits.
−Removed: • Employee Training and Awareness.
−Removed: Our employees are the first line of defense with respect to cyber/information security protection.
−Removed: Each employee is responsible for protecting the Bank and customer information.
−Removed: Employees are provided with training at initial onboarding and thereafter regarding information security and cybersecurity-related policies and procedures applicable to their respective roles within the organization.
−Removed: In addition, employees are subjected to regular simulated phishing assessments, designed to sharpen threat detection and reporting capabilities.
−Removed: In addition to training, employees are supported with solutions designed to identify, prevent, detect, respond to, and recover from cyber/information security threats and activities intended to compromise cyber/information security.
−Removed: • Customer Data Privacy Reviews.
−Removed: The Bank conducts independent external and internal reviews of internal controls relating to customer data privacy and data security in accordance with the requirements of the Gramm-Leach-Bliley Act, the Right to Financial Privacy Act, and standards established by the FFIEC.
+Added: The Bank maintains an information security program designed to assess, identify, and manage risks arising from cybersecurity threats.
+Added: The program is supported by policies, procedures, controls, and practices addressing, among other matters, information security governance, user access management, vulnerability and patch management, incident response, business continuity and disaster recovery, change management, third-party risk management, and data protection.
+Added: Cybersecurity risk management is integrated into the Bank’s broader operational risk, vendor risk, and enterprise risk management processes.
+Added: The Bank conducts internal and external assessments of information technology and information security controls, including independent audits, penetration testing, vulnerability assessments, and other reviews.
+Added: The Bank also engages third-party service providers, consultants, and independent assessors to support certain monitoring, testing, and risk assessment activities.
+Added: The Bank’s information security framework is informed by applicable regulatory guidance, including Federal Financial Institutions Examination Council (“FFIEC”) guidance, and industry practices.
+Added: The Bank continues to enhance its technology, information security, and data infrastructure in support of operational resiliency, risk management, and management reporting.
+Added: Employees receive information security awareness training at onboarding and periodically thereafter, and the Bank conducts simulated phishing exercises and other awareness activities intended to support employee identification and reporting of potential threats.
+Added: The Bank also maintains policies and processes relating to customer information privacy and data security and evaluates certain third-party service providers that perform substantial data processing or information security services as part of its technology and information security risk management processes.
Cybersecurity Governance:
−Removed: • Board Oversight.
−Removed: The Audit Committees of the Company and the Bank review and monitor the effectiveness of the Bank’s internal controls, including those controls related to information security, based on independent external audit and internal audit reports.
−Removed: The Boards of Directors of the Company and the Bank review a formal Information Security Report at least annually, a Gramm-Leach-Bliley Act (“GLBA”) report annually and receive periodic reports on cyber/information security topics and matters.
−Removed: As required by federal banking laws and regulations, the Bank’s cyber/information security risk management practices include risk assessments, controls, and practices specifically for cybersecurity, information technology deployment and third-party information technology vendor risk management.
−Removed: • CIO Responsibilities.
−Removed: The Information Services Division of the Bank is primarily responsible for identifying, assessing and managing material risks from cyber/information security threats.
−Removed: Information security management is conducted by the CIO of the Bank.
−Removed: Our CIO monitors, evaluates and adjusts the Bank’s Information Security Program, considering any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and changing business arrangements, such as technology development initiatives, outsourcing arrangements, and changes to customer information systems.
−Removed: Our CIO has been working in IT infrastructure for the past 25 years.
−Removed: His experiences include cybersecurity and information security, IT compliance, audit reviews, policies, incident response and annual processes.
−Removed: He has managed IT technology at leading brokerages, and oversees information security and cybersecurity at our Bank.
−Removed: He received Certified Banking Security Manager (CBSM) certification in 2020.
−Removed: He also manages the third-party risk management at our Bank since 2021.
−Removed: The IT Steering Committee and Management Risk Committee reviews and coordinates the status and results of information security controls, network penetration, business continuity/disaster recovery testing, and incident response plan testing.
+Added: The Boards of Directors of the Company and the Bank oversee cybersecurity risk management as part of their broader oversight of enterprise risk and internal controls.
+Added: The Boards receive periodic reporting regarding information security, cybersecurity, technology risk, and related audit and assessment matters, including at least annual information security and Gramm-Leach-Bliley Act (“GLBA”) reporting.
+Added: Management is responsible for the day-to-day administration of the Bank’s Information Security Program.
+Added: The Bank’s Information Services Division, under the oversight of the Chief Information Security Officer (“ CISO ”), is primarily responsible for identifying, assessing, and managing risks arising from cybersecurity and information security threats.
+Added: The CISO has significant experience in information security, cybersecurity, privacy, compliance, incident response, and technology risk management and holds relevant industry certifications.
+Added: Management committees, including the IT Steering Committee and Management Risk Committee, review and coordinate matters relating to information security controls, penetration testing, business continuity and disaster recovery testing, and incident response plan exercises.
Information Security Incident Responses
−Removed: The Bank maintains information security incident response plans for various information security/data breach scenarios.
−Removed: The Bank tests its incident response plans at least annually.
−Removed: Pursuant to applicable federal and state laws, regulations and FFIEC standards, the Bank maintains incident response notification procedures for affected customers, including notification of federal regulatory authorities and law enforcement.
−Removed: For the preservation of all possible avenues for law enforcement, the Bank does not disclose information security incidents to the general public unless required by law or as directed by applicable lawful authority.
+Added: The Bank maintains incident response plans for information security and data breach scenarios and tests those plans at least annually.
+Added: The Bank’s incident response procedures include processes for escalation, containment, recovery, and, where applicable, notification to customers, regulators, law enforcement, and other parties consistent with applicable legal and regulatory requirements.
Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.