Item 1B. Unresolved Staff Comments
ITEM
1B. UNRESOLVED
STAFF COMMENTS.
None.
ITEM
C. CYBERSECURITY.
Risk
Management & Strategy.
The
Company uses an enterprise risk management and financial framework to oversee its risks, including risks from cybersecurity incidents,
as further described below. The Company’s information technology & cybersecurity risk management is a continuous process
that includes identification, assessment, classification, and management of threats that could adversely impact our ability to
maintain the integrity of Bank data and systems, prevent unauthorized access to confidential data and Bank systems, and achieve
the Company’s operational, financial, reputational, legal and regulatory compliance requirements or objectives. Please see
Item 1A. Risk Factors – Risks Related to Cybersecurity and Data Privacy – “ We Face Cybersecurity Risks and
Risks Associated With Security Breaches Which Have the Potential to Disrupt Our Operations, Cause Material Harm to Our Financial
Condition, Result in Misappropriation of Assets, Compromise Confidential Information and/or Damage Our Business Relationships
and Can Provide No Assurance That the Steps We and Our Service Providers Take in Response to These Risks Will Be Effective ”
for our disclosures regarding the most pertinent risks we may experience from cybersecurity threats.
The
Bank has a management-level Strategic Technology Oversight Committee (the “TOC”). Members of the TOC include the Bank’s
Information Security Officer (the “ISO”), the Chief Information Officer as well as representatives of each department,
including Senior Officers and/or their designees. The TOC reviews the status of various tactical and strategic projects; emerging
technologies; cybersecurity, availability and performance metrics; IT and Business Continuity policies; Business Continuity test
results and IT & Cybersecurity Risk Assessment results to monitor the extent of risk, evaluate the effectiveness of mitigating
controls in place and ensure the level of risk remains within tolerance through acceptance, or further mitigation, transfer or
elimination of the risk.
Additionally,
the Bank has an ISO Metrics Oversight Committee (the “ISO Metrics Committee”) which meets on a monthly basis with
a focus on cybersecurity. Members of the ISO Metrics Committee include the ISO, the Chief Information Officer, the Chief Risk
Officer, as well as members of the information technology team involved with cybersecurity and infrastructure. The function of
the ISO Metrics Committee is to review monthly cybersecurity metrics to support discussion of cyber threats, cyber risk trends,
and risk mitigation as well as to participate in an annual tabletop business disruption exercise to assess the Bank’s resilience
and readiness should such an event occur.
All
employees participate in cybersecurity and social engineering training. The Board also receives formal training annually. The
Bank conducts social engineering tests for employees, such as phishing tests, throughout the year. We consider employee awareness
and training to be a critical component of the Bank’s cybersecurity program.
Third-party
relationships, including vendor relationships, can offer the Bank a variety of opportunities to enhance its product and servicing
offerings along with facilitating operational functions or business activities. Outsourcing processes or functions does not diminish
the Bank’s responsibility to ensure that the third-party activity is conducted in a safe and sound manner and in compliance
with applicable laws, regulations, and internal policies. Oversight for the potential risks of third-party relationships lies
with the Bank’s management and the Board.
The
Bank maintains a third-party risk management oversight program to effectively assess, measure, monitor and control the risks associated
with vendor relationships. The Bank manages its third-party relationships through the use of informed risk assessments, due-diligence
reviews, and ongoing oversight and monitoring. Information security and cybersecurity risks are included as elements in the third-party
risk management process and are assessed for vendor relationships with access to confidential Bank or customer data.
49
The
Bank uses industry standard assessment frameworks as part of its overall cybersecurity risk assessment. Industry standard assessment
frameworks are used to evaluate the effectiveness of the Bank’s mitigating controls and support initiatives to achieve continuous
improvements in the efficacy of the control environment. The Bank’s TOC and Enterprise Risk Management framework provide
ongoing oversight and governance of technology and cybersecurity risk management activities to ensure alignment with the Bank’s
risk appetite. Independent audits are performed periodically to review the Bank’s mitigating controls as well as to conduct
penetration testing of the Bank’s internal and external systems to help assess the effectiveness of the Bank’s security
controls. Additionally, on an annual basis, an independent auditor tests our employees’ awareness of and resilience to various
social engineering tactics to provide independent verification and to augment the Bank’s internal testing. Results of the
audits are reported through the Bank’s Audit Committee, and ultimately to the Bank’s Board.
The
Bank also has a relationship with a third-party Security Operations Center that provides continuous monitoring of all traffic
in our environment for anomalies as well as services, as needed, to assist in conducting forensic analysis, correlation and remediation
activities for any potential indications of compromise.
Governance.
The
Finance and Risk Management Committee is a standing committee of the Board formed in January 2014 to assist the Board and the
Executive Committee of the Board in fulfilling their responsibility with respect to the oversight of the Company’s (1) enterprise
risk management and financial framework, including all risks associated therewith, including risks related to cyber incidents
and (2) policies and practices relating to financial matters, including but not limited to, capital, liquidity and financing,
as well as to merger, acquisition and divestiture activity. The Finance and Risk Management Committee reports to the Board regarding
the Company’s risk profile, as well as its enterprise risk management framework, including the significant policies and
practices employed to manage such risks, as well as the overall adequacy of the enterprise risk management function.
Material
risks and results from any industry standard risk assessments parties, including any recommendations to further mitigate, transfer
or eliminate risks, if applicable, are reported annually to the TOC, as well as to the Board’s Finance and Risk Management
Committee, who then reports the results to the Bank’s Board. Further, these results are included in the Board’s annual
Information Security Program Report.
Technology
and cybersecurity risk metrics are two of the Bank’s primary categorical risks defined in the Bank’s enterprise risk
management framework. The Enterprise Risk Management Dashboard, which includes ongoing monitoring of current and emerging technology
and cybersecurity risks, is presented to the Finance and Risk Management Committee and to the Bank’s Board on a tri-annual
basis. In addition, reports on the monitoring of third-party relationships, particularly critical relationships, are presented
to the Finance and Risk Management Committee and to the Bank’s Board.
The
Bank’s Board, through the Finance and Risk Management Committee, has oversight of cybersecurity incident disclosures, if
applicable. The Finance and Risk Management Committee shall annually review with Management the Company’s Business Continuity
Plan (the “BCP”), the BCP Policy, BCP testing results and the Company’s Pandemic Plan and Cyber Incident Response
Plan and programs, including materiality determination criteria and escalation protocols with respect to the prompt reporting
of material cyber incidents to the Finance and Risk Management Committee and the Bank’s Board. The Finance and Risk Management
Committee shall further review with Management and report to the Bank’s Board any cyber incident disclosure reports to or
from regulators with respect thereto, and the root cause and remediation and enhancement efforts with respect thereto.
The
Bank’s information technology team maintains and develops their knowledge through various business, technical and cybersecurity-related
programs, certificates and degrees, including a senior member of the team who holds a Master of Business Administration and another
team member holding a Master’s Degree in Cybersecurity Management. Collectively, the senior members of the information technology
team have approximately 75 years of experience in technology and cybersecurity, and the information technology team collectively
holds and maintains continuing education in various technology and cybersecurity certification areas. The Bank’s ISO holds
the designation of Certified Cyber Crimes Investigator from the IAFCI and also maintains continuing education related to cybersecurity.
50