XML 42 R25.htm IDEA: XBRL DOCUMENT v3.25.0.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Abstract]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Identifying and assessing cybersecurity risks is integrated into our overall risk management program and processes. Cybersecurity risks related to our business, technical operations, data, and privacy, along with cybersecurity risk-related compliance issues, are identified and addressed through a framework consisting of third-party assessments, internal information technology audits, information security assessments, and risk and compliance reviews. We conduct regular privacy and cybersecurity reviews of systems, audit applicable data and information policies, perform penetration and vulnerability testing using third-party tools to test security controls, perform regular training and assessments for the Board of Directors and employees, monitor emerging data privacy and information security laws and regulations, and implement applicable changes to improve our overall security posture.  We regularly engage third-party auditors to assess our cybersecurity program and compliance with all applicable “best practices” and regulations. The Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments and to remediate material identified vulnerabilities.

We have in place a robust incident response process that helps ensure our preparedness for a cybersecurity incident including our ability to detect, analyze, contain, remediate, and recover from a security incident as well as conduct post-incident analysis to avoid future incidents.  Incident response process activities are overseen by cross-functional leadership in Risk Management, Operations, Information Security, Compliance, and Information Systems.  Security events and incidents are evaluated, ranked by severity, and prioritized for response and remediation. Incidents are evaluated to determine materiality and operational, business, and overall privacy impacts. We conduct regular exercises and drills to simulate responses to various cybersecurity incidents. The incident response team, including management, coordinates with technical and business stakeholders to further analyze risks and enhance detection, mitigation, and remediation strategies incorporated in the incident response program.

Our risk management program regularly assesses third party risks (inclusive of fourth-party risk) by conducting activities to identify and mitigate risks from third parties (e.g., vendors, suppliers, and other business partners). Cybersecurity risks are evaluated when selecting and managing applicable third-parties that handle or process employee, business, or customer data, and a review process that includes due diligence over a third-party’s information security and technology control environment is conducted at onboarding and periodically throughout the lifecycle of the relationship to ensure that systems of third- parties meet certain security baseline requirements. We maintain procedures to respond to, manage and mitigate third-party cybersecurity events and vulnerabilities when identified.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
Identifying and assessing cybersecurity risks is integrated into our overall risk management program and processes. Cybersecurity risks related to our business, technical operations, data, and privacy, along with cybersecurity risk-related compliance issues, are identified and addressed through a framework consisting of third-party assessments, internal information technology audits, information security assessments, and risk and compliance reviews. We conduct regular privacy and cybersecurity reviews of systems, audit applicable data and information policies, perform penetration and vulnerability testing using third-party tools to test security controls, perform regular training and assessments for the Board of Directors and employees, monitor emerging data privacy and information security laws and regulations, and implement applicable changes to improve our overall security posture.  We regularly engage third-party auditors to assess our cybersecurity program and compliance with all applicable “best practices” and regulations. The Company adjusts its information security policies, standards, processes and practices as necessary based on the information provided by these assessments and to remediate material identified vulnerabilities.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block]

In 2024, we did not identify any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition
Cybersecurity Risk Board of Directors Oversight [Text Block] The Board of Directors oversees management’s processes for identifying and mitigating risks, including cybersecurity risks, to help manage our risk exposure to meet our strategic objectives. Executive Management and our Information Security Officer (“ISO”) regularly brief the Board of Directors on our cybersecurity and information security posture and ensure the Board is apprised of emerging risks and cybersecurity incidents deemed to have a direct or indirect business impact.

The Audit & Risk Committee meets on a monthly basis to receive updates from management, including leaders from Information Systems, Information Security, Risk Management, and Compliance, on matters of cybersecurity risks and mitigation initiatives.  The leaders from these areas each bring over 20 years of professional experience and certifications in information technology, information security, information systems audit, compliance, and risk management.  This group of leaders provides updates on existing and new cybersecurity risks, status updates on how management is addressing or mitigating cyber risks and cybersecurity or privacy incidents, and progress on key cybersecurity initiatives.

The Electronic Data Processing (“EDP”) Steering Committee is a senior management level committee that meets at least quarterly to discuss a variety of information technology and cybersecurity matters, which form the basis for providing status reports to the Board of Directors.  The committee is responsible for monitoring all Information Systems-related projects and initiatives, facilitating the remediation of issues that could adversely impact the ability of the Information Systems Department to perform its function, and allocating available resources to the highest priority projects and initiatives.  The Chief Administrative Officer chairs the EDP Steering Committee and members of Executive Management, Information Systems, Information Security, Treasury Management, Retail and Wholesale Banking departments are represented in the meetings.  In addition to project management guidance, the committee provides oversight of and direction for the Information Security Program, monitors cybersecurity risks, and helps ensure prompt remediation of cybersecurity incidents.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
The Audit & Risk Committee meets on a monthly basis to receive updates from management, including leaders from Information Systems, Information Security, Risk Management, and Compliance, on matters of cybersecurity risks and mitigation initiatives.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Executive Management and our Information Security Officer (“ISO”) regularly brief the Board of Directors on our cybersecurity and information security posture and ensure the Board is apprised of emerging risks and cybersecurity incidents deemed to have a direct or indirect business impact.
Cybersecurity Risk Role of Management [Text Block]
The Audit & Risk Committee meets on a monthly basis to receive updates from management, including leaders from Information Systems, Information Security, Risk Management, and Compliance, on matters of cybersecurity risks and mitigation initiatives.  The leaders from these areas each bring over 20 years of professional experience and certifications in information technology, information security, information systems audit, compliance, and risk management.  This group of leaders provides updates on existing and new cybersecurity risks, status updates on how management is addressing or mitigating cyber risks and cybersecurity or privacy incidents, and progress on key cybersecurity initiatives.

The Electronic Data Processing (“EDP”) Steering Committee is a senior management level committee that meets at least quarterly to discuss a variety of information technology and cybersecurity matters, which form the basis for providing status reports to the Board of Directors.  The committee is responsible for monitoring all Information Systems-related projects and initiatives, facilitating the remediation of issues that could adversely impact the ability of the Information Systems Department to perform its function, and allocating available resources to the highest priority projects and initiatives.  The Chief Administrative Officer chairs the EDP Steering Committee and members of Executive Management, Information Systems, Information Security, Treasury Management, Retail and Wholesale Banking departments are represented in the meetings.  In addition to project management guidance, the committee provides oversight of and direction for the Information Security Program, monitors cybersecurity risks, and helps ensure prompt remediation of cybersecurity incidents.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
The Electronic Data Processing (“EDP”) Steering Committee is a senior management level committee that meets at least quarterly to discuss a variety of information technology and cybersecurity matters, which form the basis for providing status reports to the Board of Directors.  The committee is responsible for monitoring all Information Systems-related projects and initiatives, facilitating the remediation of issues that could adversely impact the ability of the Information Systems Department to perform its function, and allocating available resources to the highest priority projects and initiatives.  The Chief Administrative Officer chairs the EDP Steering Committee and members of Executive Management, Information Systems, Information Security, Treasury Management, Retail and Wholesale Banking departments are represented in the meetings.  In addition to project management guidance, the committee provides oversight of and direction for the Information Security Program, monitors cybersecurity risks, and helps ensure prompt remediation of cybersecurity incidents.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The leaders from these areas each bring over 20 years of professional experience and certifications in information technology, information security, information systems audit, compliance, and risk management.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] We conduct regular exercises and drills to simulate responses to various cybersecurity incidents. The incident response team, including management, coordinates with technical and business stakeholders to further analyze risks and enhance detection, mitigation, and remediation strategies incorporated in the incident response program.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true