XML 90 R37.htm IDEA: XBRL DOCUMENT v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
Risk Management and Strategy

NewtekOne maintains a Risk Management framework to identify, measure, mitigate, monitor and report material risks to the Risk Committee of our Board. Our Risk Management process includes participation by our senior management and employees across NewtekOne and its consolidated subsidiaries and is overseen by our Chief Risk Officer who reports to the Risk Committee and our CEO. The Risk Committee sets the risk appetite across NewtekOne while the executive leadership team and our associates identify and monitor current and emerging risks and manage those risks within our risk appetite. Cybersecurity has been identified among the material risks in our business and the following approach has been developed to address cybersecurity.

IPM, a third-party provider, manages our IT infrastructure and cybersecurity program under the oversight of our Chief Technology and Chief Information Security Officer (“CTO/CISO”), and collaborates with us to develop and implement our enterprise-wide cybersecurity risk management program (“Program”). This Program is designed to safeguard our assets and operations, protect the confidentiality of nonpublic, sensitive personal and business information, and ensure the integrity, security, and availability of our information and information systems, as follows:

Assessment, Identification, and Management of Material Risks:

1.Comprehensive Risk Assessments: We conduct regular and comprehensive assessments to identify potential cybersecurity risks to our organization. These assessments encompass identification of internal and external threats and vulnerabilities facing our internal systems and applications, networks, and data repositories within our digital ecosystem.
2.Threat Intelligence Monitoring: We continuously monitor threat intelligence sources to stay abreast of emerging cyber threats and trends. This proactive approach enables us to anticipate potential risks and take preemptive measures for timely mitigation.
3.Risk Prioritization: Following the assessment phase, we prioritize identified risks based on their potential impact on our operations, data integrity, confidentiality, and reputation. This risk-based approach allows us to allocate resources effectively and prioritize remediation efforts.
4.Mitigation Strategies: We develop and implement robust mitigation strategies tailored to address identified cybersecurity risks. These strategies may include the deployment of new or enhancement of existing technical controls, such as firewalls, intrusion detection systems, and encryption protocols, as well as the implementation of policies, procedures, and employee training programs to promote cybersecurity awareness and adherence to internal and industry best practices.

Integration into Overall Risk Management System:

Our cybersecurity risk management processes are fully integrated into our overall risk management program and corporate governance framework. This integration ensures that cybersecurity considerations are embedded within our strategic decision-making processes and are aligned with our broader business objectives. By integrating cybersecurity into our overall risk management system, we promote a comprehensive approach to risk mitigation and resilience-building across the organization.
Engagement of Assessors, Consultants, and Auditors:

1.Internal Expertise: Our CTO/CISO is responsible for overseeing the Company’s IT infrastructure and cybersecurity program and reports to our executive management team and the Technology Steering Committee of our Board. Our CTO/CISO has over 25 years of experience in enterprise technology solutions, with expertise in managed services, private cloud, service operations, and security. He is committed to driving reliability of services while prioritizing robust security measures.
2.External Expertise: We recognize the value of external expertise in assessing and enhancing our cybersecurity posture. As of the January 2, 2025 close of our divestiture of Newtek Technology Services (“NTS”) to IPM, we and IPM entered into a Master Services Agreement pursuant to which IPM provides us with the same services NTS provided to the Company prior to the divestiture. Our CTO/CISO is responsible for overseeing IPM’s provisioning of the managed technology and security services, including cybersecurity, to us and all of our subsidiaries. In addition, we engage assessors, consultants, auditors, and other third-party experts with specialized knowledge in cybersecurity to conduct independent assessments, penetration testing, vulnerability scans, and audits to evaluate the effectiveness of our cybersecurity controls and identify areas for improvement.
3.Continuous Improvement: The insights and recommendations provided by external assessors, consultants, and auditors inform our ongoing efforts to strengthen our cybersecurity defenses and continually mature the Program. We prioritize the implementation of their recommendations, to ensure our cybersecurity measures remain robust and adaptive to evolving threats.

Oversight of Third-Party Service Providers:

Our management is actively engaged in overseeing our third-party service providers. Our Enterprise Third Party Risk Management (“TPRM”) Policy establishes requirements and practices used to oversee and manage the activities of third parties with whom we have a relationship, under which we identify, measure, monitor, and manage third-party risk (including information cybersecurity risks) in alignment with our strategic objectives and in compliance with applicable law. Any identified threats, vulnerabilities, weaknesses, or cybersecurity incidents are addressed as appropriate through our CTO/CISO and IPM, as needed.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block]
NewtekOne maintains a Risk Management framework to identify, measure, mitigate, monitor and report material risks to the Risk Committee of our Board. Our Risk Management process includes participation by our senior management and employees across NewtekOne and its consolidated subsidiaries and is overseen by our Chief Risk Officer who reports to the Risk Committee and our CEO. The Risk Committee sets the risk appetite across NewtekOne while the executive leadership team and our associates identify and monitor current and emerging risks and manage those risks within our risk appetite. Cybersecurity has been identified among the material risks in our business and the following approach has been developed to address cybersecurity.
IPM, a third-party provider, manages our IT infrastructure and cybersecurity program under the oversight of our Chief Technology and Chief Information Security Officer (“CTO/CISO”), and collaborates with us to develop and implement our enterprise-wide cybersecurity risk management program (“Program”). This Program is designed to safeguard our assets and operations, protect the confidentiality of nonpublic, sensitive personal and business information, and ensure the integrity, security, and availability of our information and information systems
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Governance

Our Board oversees material risks facing the Company. For some categories of risk, the Board has empowered committees to provide more focused oversight. In the case of cybersecurity and technology risk, in 2024 the Board formed the Technology Steering Committee which has that responsibility.

The Technology Steering Committee is informed of risks from cybersecurity threats through regular reports from the Company’s management, including our CTO/CISO, who is responsible for overseeing our cybersecurity risk management program. Our CTO/CISO is chiefly responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies and standards; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations, industry, and third-party risk assessment requirements; keeping abreast of developing security threats, and helping both the Board and the Technology Steering Committee understand potential security concerns that could arise from the changing threat landscape; overseeing and implementing regular security awareness training of all employees on cybersecurity; and supporting effective communication with users to minimize potential security issues. Our CTO/CISO reports to the Technology Steering Committee on a quarterly basis or more frequently as needed, on the state of our cybersecurity risk management program through updates in connection with cybersecurity matters.

The Technology Steering Committee also receives regular reports on how management identifies, assesses, and manages cybersecurity and broader technology risks. The Technology Steering Committee reviews these reports and discusses them with management. The Technology Steering Committee reports to the full Board on key aspects of management’s presentations regarding cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Technology Steering Committee.
While our Board and Technology Steering Committee oversee cybersecurity and technology risk, our senior leadership is responsible for identifying, assessing, and managing our exposure to risks from cybersecurity threats. Accountability of our cybersecurity program is housed within IPM, with oversight by our CTO/CISO. Our CTO/CISO is responsible for assessing and managing material risks from cybersecurity threats, including oversight and monitoring of the prevention, detection, mitigation and remediation of cybersecurity threats. Our CTO/CISO oversees the IPM team that is responsible for the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The IPM team consists of individuals that have the requisite knowledge, skills and expertise necessary to appropriately respond to a cybersecurity incident. Our CTO/CISO coordinates with our and our subsidiaries’ executive officers relating to potentially material cybersecurity incidents and regularly discusses with the Technology Steering Committee the effectiveness of the Company’s technological security capabilities associated with disaster recovery, data protection, cyber threat detection and response and, management and mitigation of technology-related compliance risks.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block]
Our Board oversees material risks facing the Company. For some categories of risk, the Board has empowered committees to provide more focused oversight. In the case of cybersecurity and technology risk, in 2024 the Board formed the Technology Steering Committee which has that responsibility.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] ur CTO/CISO reports to the Technology Steering Committee on a quarterly basis or more frequently as needed, on the state of our cybersecurity risk management program through updates in connection with cybersecurity matters.The Technology Steering Committee also receives regular reports on how management identifies, assesses, and manages cybersecurity and broader technology risks. The Technology Steering Committee reviews these reports and discusses them with management. The Technology Steering Committee reports to the full Board on key aspects of management’s presentations regarding cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Technology Steering Committee.
Cybersecurity Risk Role of Management [Text Block]
The Technology Steering Committee is informed of risks from cybersecurity threats through regular reports from the Company’s management, including our CTO/CISO, who is responsible for overseeing our cybersecurity risk management program. Our CTO/CISO is chiefly responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies and standards; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations, industry, and third-party risk assessment requirements; keeping abreast of developing security threats, and helping both the Board and the Technology Steering Committee understand potential security concerns that could arise from the changing threat landscape; overseeing and implementing regular security awareness training of all employees on cybersecurity; and supporting effective communication with users to minimize potential security issues. Our CTO/CISO reports to the Technology Steering Committee on a quarterly basis or more frequently as needed, on the state of our cybersecurity risk management program through updates in connection with cybersecurity matters.

The Technology Steering Committee also receives regular reports on how management identifies, assesses, and manages cybersecurity and broader technology risks. The Technology Steering Committee reviews these reports and discusses them with management. The Technology Steering Committee reports to the full Board on key aspects of management’s presentations regarding cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Technology Steering Committee.
While our Board and Technology Steering Committee oversee cybersecurity and technology risk, our senior leadership is responsible for identifying, assessing, and managing our exposure to risks from cybersecurity threats. Accountability of our cybersecurity program is housed within IPM, with oversight by our CTO/CISO. Our CTO/CISO is responsible for assessing and managing material risks from cybersecurity threats, including oversight and monitoring of the prevention, detection, mitigation and remediation of cybersecurity threats. Our CTO/CISO oversees the IPM team that is responsible for the prevention, detection, mitigation and remediation of cybersecurity threats and incidents. The IPM team consists of individuals that have the requisite knowledge, skills and expertise necessary to appropriately respond to a cybersecurity incident. Our CTO/CISO coordinates with our and our subsidiaries’ executive officers relating to potentially material cybersecurity incidents and regularly discusses with the Technology Steering Committee the effectiveness of the Company’s technological security capabilities associated with disaster recovery, data protection, cyber threat detection and response and, management and mitigation of technology-related compliance risks.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block]
The Technology Steering Committee is informed of risks from cybersecurity threats through regular reports from the Company’s management, including our CTO/CISO, who is responsible for overseeing our cybersecurity risk management program. Our CTO/CISO is chiefly responsible for developing, maintaining, and enforcing cybersecurity and cyber risk-related policies and standards; ensuring the Company and its subsidiaries satisfy requirements of relevant regulations, industry, and third-party risk assessment requirements; keeping abreast of developing security threats, and helping both the Board and the Technology Steering Committee understand potential security concerns that could arise from the changing threat landscape; overseeing and implementing regular security awareness training of all employees on cybersecurity; and supporting effective communication with users to minimize potential security issues. Our CTO/CISO reports to the Technology Steering Committee on a quarterly basis or more frequently as needed, on the state of our cybersecurity risk management program through updates in connection with cybersecurity matters.
The Technology Steering Committee also receives regular reports on how management identifies, assesses, and manages cybersecurity and broader technology risks. The Technology Steering Committee reviews these reports and discusses them with management. The Technology Steering Committee reports to the full Board on key aspects of management’s presentations regarding cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Technology Steering Committee.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block]
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] ur CTO/CISO reports to the Technology Steering Committee on a quarterly basis or more frequently as needed, on the state of our cybersecurity risk management program through updates in connection with cybersecurity matters.The Technology Steering Committee also receives regular reports on how management identifies, assesses, and manages cybersecurity and broader technology risks. The Technology Steering Committee reviews these reports and discusses them with management. The Technology Steering Committee reports to the full Board on key aspects of management’s presentations regarding cybersecurity and broader technology risks. All members of the Board have access to written cybersecurity reports that are provided to the Technology Steering Committee.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true