Item 1B. Unresolved Staff Comments
ITEM 1B. Unresolved Staff Comments
None.
2025 FORM 10-K 18
ITEM 1C. Cybersecurity
Cyber/information security is an important component of the Company’s enterprise risk management framework. As an insured depository institution, threats to information security are present and growing, and the potential exists for a cybersecurity incident to occur, which could disrupt business operations or compromise sensitive data. To date, the Company has not, to its knowledge, experienced an incident materially affecting or reasonably likely to materially affect the Company.
Cybersecurity Risk Management and Strategy:
The Bank maintains an information security program designed to assess, identify, and manage risks arising from cybersecurity threats. The program is supported by policies, procedures, controls, and practices addressing, among other matters, information security governance, user access management, vulnerability and patch management, incident response, business continuity and disaster recovery, change management, third-party risk management, and data protection. Cybersecurity risk management is integrated into the Bank’s broader operational risk, vendor risk, and enterprise risk management processes.
The Bank conducts internal and external assessments of information technology and information security controls, including independent audits, penetration testing, vulnerability assessments, and other reviews. The Bank also engages third-party service providers, consultants, and independent assessors to support certain monitoring, testing, and risk assessment activities. The Bank’s information security framework is informed by applicable regulatory guidance, including Federal Financial Institutions Examination Council (“FFIEC”) guidance, and industry practices. The Bank continues to enhance its technology, information security, and data infrastructure in support of operational resiliency, risk management, and management reporting.
Employees receive information security awareness training at onboarding and periodically thereafter, and the Bank conducts simulated phishing exercises and other awareness activities intended to support employee identification and reporting of potential threats. The Bank also maintains policies and processes relating to customer information privacy and data security and evaluates certain third-party service providers that perform substantial data processing or information security services as part of its technology and information security risk management processes.
Cybersecurity Governance:
The Boards of Directors of the Company and the Bank oversee cybersecurity risk management as part of their broader oversight of enterprise risk and internal controls. The Boards receive periodic reporting regarding information security, cybersecurity, technology risk, and related audit and assessment matters, including at least annual information security and Gramm-Leach-Bliley Act (“GLBA”) reporting.
Management is responsible for the day-to-day administration of the Bank’s Information Security Program. The Bank’s Information Services Division, under the oversight of the Chief Information Security Officer (“ CISO ”), is primarily responsible for identifying, assessing, and managing risks arising from cybersecurity and information security threats. The CISO has significant experience in information security, cybersecurity, privacy, compliance, incident response, and technology risk management and holds relevant industry certifications.
Management committees, including the IT Steering Committee and Management Risk Committee, review and coordinate matters relating to information security controls, penetration testing, business continuity and disaster recovery testing, and incident response plan exercises.
Information Security Incident Responses
The Bank maintains incident response plans for information security and data breach scenarios and tests those plans at least annually. The Bank’s incident response procedures include processes for escalation, containment, recovery, and, where applicable, notification to customers, regulators, law enforcement, and other parties consistent with applicable legal and regulatory requirements.