XML 52 R34.htm IDEA: XBRL DOCUMENT v3.25.1
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2024
Cybersecurity Risk Management, Strategy, and Governance [Line Items]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]
We recognize the security of our banking operations is critical to protecting our customers, maintaining our reputation and preserving the value of the Company. Our board of directors is actively involved in oversight of the Company’s risk management program, and cybersecurity represents an important component of the Company’s overall approach to enterprise risk management (“ERM”). The Company maintains a cybersecurity and information technology (“IT”) risk management program designed to prevent, detect and respond to information security threats, which are fully integrated into the Company’s ERM program.
Our cybersecurity and IT risk management program is based on recognized frameworks established by the National Institute of Standards and Technology (“NIST”) Cybersecurity Framework, as well as the banking-specific framework from the Federal Financial Institution Examination Council’s (“FFIEC’s”) Cybersecurity Assessment Tool. The Company’s program is led by our Director of Information Technology and Information Security Officer, whose teams are responsible for leading short-term and long-term enterprise-wide cybersecurity strategy, policy, standards, monitoring, architecture and processes. Our Director of Information Technology and Information Security Officer has over fifteen years of experience in the field of cybersecurity and over a decade of experience leading cyber security oversight in the banking industry.
Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] The Company maintains a cybersecurity and information technology (“IT”) risk management program designed to prevent, detect and respond to information security threats, which are fully integrated into the Company’s ERM program.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] false
Cybersecurity Risk Board of Directors Oversight [Text Block]
Although it is management's job to assess and manage our Company's exposure to risk, our board of directors oversees our Company's ERM, including cybersecurity and IT risks and threats, and establishes policies that govern the process. Our board conducts much of its risk oversight activities through our Audit Committee, which works closely with our Chief Risk Officer and Internal Audit Manager. The Audit Committee has primary management responsibility for oversight of operations, technology and operational risk, including information security, fraud, vendor, data protections and privacy, business continuity and cybersecurity risks. Our Audit Committee meets at least quarterly with our Chief Risk Officer, Internal Audit Manager and other members of management to assess, among other things, cyber threats or risks to align the Company for effective cybersecurity risk management and reporting. The Audit Committee receives quarterly reports from our Internal Audit Manager and Director of Information Technology and Information Security Officer on, among other things, the Company’s cyber risks and threats, the status of projects to strengthen the Company’s information security program, the emerging threat landscape and key metrics from cybersecurity systems and monitoring. Our Chief Risk Officer provides a presentation on ERM to the full board at least once annually. From time to time our Audit
Committee also receives updates between meetings from our Chief Risk Officer, Chief Executive Officer, Chief Financial Officer and other members of management relating to risk oversight matters.
Security event monitoring and detection
Our processes for assessing, identifying, and managing material risks from cybersecurity threats include using a wide-range of industry-leading security tools, regularly updating our technology roadmaps, and mandating cybersecurity awareness, business continuity and incident response training for all employees.
Recognizing the complexity and evolving nature of cybersecurity threats, we engage a range of outside experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our cybersecurity and IT risk management systems. Engaging outside vendors enables us to leverage specialized knowledge and insights, ensuring our cybersecurity and IT risk management strategies and processes remain sound. Our collaboration with these third-parties includes threat assessments, consultation on security enhancements and regular audits, the results of these threat assessments and audits are reported to the Audit Committee. Strong vendor management and monitoring controls are enforced and require, at a minimum, annual due diligence on critical vendors.
We have implemented a comprehensive Incident Response Program to provide guidance in the event of a cybersecurity incident for contacting authorities and informing key stakeholders to ensure that any non-routine events are properly escalated. The Company participates in cybersecurity incident response exercises to test pre-planned response actions from the Company’s plan and to facilitate group discussions regarding the effectiveness of the Company’s cybersecurity incident response strategies and tactics. We use a third-party SEIM to provide 24x7x365 monitoring of logs, administrator and user actions, network and security appliances, and endpoint agents. Our Director of Information Technology and Information Security Officer actively engages with key vendors, industry participants, as well as the FS-ISAC, InfraGard, InspireCIO and SANS Internet Storm Center cybersecurity collaboration organizations.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] Although it is management's job to assess and manage our Company's exposure to risk, our board of directors oversees our Company's ERM, including cybersecurity and IT risks and threats, and establishes policies that govern the process. Our board conducts much of its risk oversight activities through our Audit Committee, which works closely with our Chief Risk Officer and Internal Audit Manager.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] Our Audit Committee meets at least quarterly with our Chief Risk Officer, Internal Audit Manager and other members of management to assess, among other things, cyber threats or risks to align the Company for effective cybersecurity risk management and reporting. The Audit Committee receives quarterly reports from our Internal Audit Manager and Director of Information Technology and Information Security Officer on, among other things, the Company’s cyber risks and threats, the status of projects to strengthen the Company’s information security program, the emerging threat landscape and key metrics from cybersecurity systems and monitoring. Our Chief Risk Officer provides a presentation on ERM to the full board at least once annually. From time to time our Audit
Committee also receives updates between meetings from our Chief Risk Officer, Chief Executive Officer, Chief Financial Officer and other members of management relating to risk oversight matters.
Cybersecurity Risk Role of Management [Text Block] Although it is management's job to assess and manage our Company's exposure to risk
Cybersecurity Risk Management Positions or Committees Responsible [Flag] true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] The Company’s program is led by our Director of Information Technology and Information Security Officer, whose teams are responsible for leading short-term and long-term enterprise-wide cybersecurity strategy, policy, standards, monitoring, architecture and processes.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] Our Director of Information Technology and Information Security Officer has over fifteen years of experience in the field of cybersecurity and over a decade of experience leading cyber security oversight in the banking industry.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] We have implemented a comprehensive Incident Response Program to provide guidance in the event of a cybersecurity incident for contacting authorities and informing key stakeholders to ensure that any non-routine events are properly escalated. The Company participates in cybersecurity incident response exercises to test pre-planned response actions from the Company’s plan and to facilitate group discussions regarding the effectiveness of the Company’s cybersecurity incident response strategies and tactics. We use a third-party SEIM to provide 24x7x365 monitoring of logs, administrator and user actions, network and security appliances, and endpoint agents. Our Director of Information Technology and Information Security Officer actively engages with key vendors, industry participants, as well as the FS-ISAC, InfraGard, InspireCIO and SANS Internet Storm Center cybersecurity collaboration organizations
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true