Item 1B. Unresolved Staff Comments
Item 1B. Unresolved Staff Comments
None.
Item 1C. Cybersecurity
The Company has developed and maintains an information security program designed to assess, identify, and monitor cybersecurity risks in order to protect one of its most critical assets – information. The program includes information security governance, documented policies and procedures, and technical safeguards intended to protect information owned by or entrusted to the Company.
The Company regularly evaluates its exposure to cybersecurity risks and, to the extent practicable, assesses the likelihood and potential severity of such risks, as well as their possible impact on the Company, its customers, and its employees. The effectiveness of the Company’s information security controls, processes, and procedures is evaluated through periodic internal testing and independent assessments conducted by third-party cybersecurity firms . These efforts are supplemented by regular tabletop incident response exercises and ongoing cybersecurity awareness training for employees. Results from testing, exercises, and training are used to enhance the Company’s incident response and business continuity plans, related procedures, and employee training programs.
The Company also manages cybersecurity risks arising from its relationships with third-party vendors through a comprehensive vendor management program. Vendors are assessed for cybersecurity risk as part of the onboarding process , and all assessment activities are documented within the Company’s vendor management system. The vendor review process includes evaluation of independent assurance reports and certifications, such as Service Organization Controls (SOC) reports, Payment Card Industry Data Security Standard (PCI DSS) compliance, and other relevant documentation, as applicable. Critical vendors are reviewed at least annually, with the results reported to the Board of Directors .
The Company’s information security program is led by the Chief Information Officer and the Information Security Officer , in coordination with management, the Board of Directors, and the Technology Committee . The Technology Committee provides ongoing oversight of the Company’s cybersecurity and information security program and regularly reviews cybersecurity risk assessments and related reporting from management. This oversight is further supported through engagement with independent cybersecurity firms with expertise in financial services.
Prior to Seneca Bancorp, the Chief Information Officer and the Information Security Officer served in v arious roles where he led the transformation to stabilize and secure IT infrastructure and systems. He also served as a Senior Manager of the Technology Advisory Services team where he provided technology management and advisory services to clients through a series of assessments and development of technology roadmaps aligned with business objectives.
28
Table of Contents
The Company recognizes that our overall security culture contributes to the effectiveness of our Cyber Security program. The Company has developed a Business Impact Analysis process that identifies, prioritizes and provides a formal structure for the internal and external risks that impact the organization. The Board of Directors sets the tone and direction for the Company’s use of IT and has identified the Technology Committee as having primary responsibility for oversight of the Company’s risk exposures and risk assessments and policies, including risks related to cybersecurity. The Board of Directors and Technology Committee approve and periodically review and re-approve the policy and other IT related policies. While the Board of Directors may delegate the design, implementation, and monitoring of certain IT activities to the Committee or designee, the full Board of Directors remains responsible for overseeing IT strategies and policies, including cybersecurity. To help carry out their responsibilities, Directors, management, and all employees are periodically trained to understand IT activities and risks, including cybersecurity risks. Management, via the Technology Committee and Fractional CISO, or combination, provides a status report to the Board of Directors at least annually, with more frequent communications as necessary. The report describes the overall status of the program and material matters related to the program, including security breaches, cybersecurity assessments, cybersecurity awareness training for employees and the Board of Directors.
To date, the Company has not experienced any cybersecurity incidents that have materially affected, or are reasonably likely to materially affect , its business strategy, results of operations, or financial condition. However, cybersecurity threats continue to evolve in frequency and sophistication. While the Company’s preventive and detective controls are designed to reduce cybersecurity risk, they cannot eliminate such risk entirely, particularly as new technologies, including artificial intelligence, are increasingly leveraged by threat actors. The Company monitors emerging threats and leverages guidance and resources from industry and regulatory bodies, including the Financial Services Information Sharing and Analysis Center (FS-ISAC), the Federal Financial Institutions Examination Council (FFIEC), and the National Institute of Standards and Technology (NIST), to inform its cybersecurity practices and enhance its security posture .
29
Table of Contents