Cybersecurity Risk Management and Strategy Disclosure |
12 Months Ended |
|---|---|
Dec. 31, 2025 | |
| Cybersecurity Risk Management, Strategy, and Governance [Abstract] | |
| Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] |
The Company’s information security program is designed to protect the security, confidentiality, integrity and availability of the
Company’s sensitive and personal information and client information. Employing a risk-based approach, the program systematically identifies, assesses and implements safeguards that seek to mitigate cybersecurity threats and secure the Company’s information assets, including those of our sub-servicers. The program is informed by the National Institute of Standards and Technology Cybersecurity Framework and is shaped by the legal requirements derived from authoritative sources such as the Gramm-Leach-Bliley Act and its implementing regulations and guidelines, as well as Freddie Mac’s mandates from the office of Federal Housing Enterprise Oversight. Additionally, the program is guided by relevant state laws and regulations.
Periodically, the Company, as it reasonably deems necessary, will identify and categorize potential cybersecurity threats and
vulnerabilities, determine acceptable risk tolerance for each such threat and vulnerability and implement adequate mitigation controls. At the senior executive level, the CFO is entrusted with the day-to-day oversight of the program’s development,
implementation, and maintenance. To help facilitate Company-wide compliance with the plan, the Company, as well as its subservicers,
provide ongoing training to the appropriate employees.
|
| Cybersecurity Risk Management Processes Integrated [Flag] | true |
| Cybersecurity Risk Management Processes Integrated [Text Block] |
Periodically, the Company, as it reasonably deems necessary, will identify and categorize potential cybersecurity threats and
vulnerabilities, determine acceptable risk tolerance for each such threat and vulnerability and implement adequate mitigation controls. At the senior executive level, the CFO is entrusted with the day-to-day oversight of the program’s development,
implementation, and maintenance. To help facilitate Company-wide compliance with the plan, the Company, as well as its subservicers,
provide ongoing training to the appropriate employees.
|
| Cybersecurity Risk Management Third Party Engaged [Flag] | true |
| Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false |
| Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Text Block] |
To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company.
Please refer to “Item 1A. Risk Factors – Risks Related to Our Business – We are highly dependent on information systems and third parties, and systems failures or cybersecurity incidents could disrupt our business.”
|
| Cybersecurity Risk Board of Directors Oversight [Text Block] |
Our board of directors is responsible for understanding the primary risks to our business. The board is also tasked
with developing and advancing our cybersecurity strategy, as well as evaluating the adequacy of our programs and policies. The CEO is responsible for ensuring that the board of directors comprehends the Company’s cybersecurity risk profile and
receives updates on the program and its policies on a quarterly basis or as necessary. Our current CEO is Jeffrey Lown II. Mr. Lown has a B.S. in Finance from Lehigh University and an
M.B.A. from the D’Amore-McKim School of Business at Northeastern University. Mr. Lown was appointed the Company’s President and CEO in October 2013.
As mentioned above, the CEO is responsible for the initial assessment and management of potential incidents. Furthermore, the Company has established a response plan that serves as the
foundation for addressing unauthorized cybersecurity occurrences from both a technical and regulatory perspective. The Cybersecurity Response Team (“CRT”), comprised of the CEO, General Counsel, Manager of Information Technology (“MIT”) and other personnel as each may designate, are responsible for leading all incident management and response activities. The MIT assumes a crucial role in overseeing and managing the technical facets of the CRT while the CEO provides strategic direction and decision-making, facilitating communication with other members of senior management, and disseminating pertinent information to the board of directors. The MIT, an external consultant to the Company, brings over 25 years of IT experience in the private financial sector, with a strong focus on cybersecurity. He has
implemented core IT policies, including Information Security and Incident Response, and directed cybersecurity training and testing at the Company. The MIT has also managed cloud infrastructure on Amazon Web Services and integrated automation
within trade order management systems. His expertise extends to managing IT for live trading environments and ensuring regulatory compliance. The MIT holds an MA from the State University of New York at Binghamton and a BA from Luther College.
Additionally, the Company engages a third-party provider to manage key functions, including identity access management, network
security, user and email administration, data governance, threat management, and endpoint security.
|
| Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | Our board of directors is responsible for understanding the primary risks to our business. The board is also tasked with developing and advancing our cybersecurity strategy, as well as evaluating the adequacy of our programs and policies. The CEO is responsible for ensuring that the board of directors comprehends the Company’s cybersecurity risk profile and receives updates on the program and its policies on a quarterly basis or as necessary. |
| Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] |
As mentioned above, the CEO is responsible for the initial assessment and management of potential incidents. Furthermore, the Company has established a response plan that serves as the
foundation for addressing unauthorized cybersecurity occurrences from both a technical and regulatory perspective. The Cybersecurity Response Team (“CRT”), comprised of the CEO, General Counsel, Manager of Information Technology (“MIT”) and other personnel as each may designate, are responsible for leading all incident management and response activities. The MIT assumes a crucial role in overseeing and managing the technical facets of the CRT while the CEO provides strategic direction and decision-making, facilitating communication with other members of senior management, and disseminating pertinent information to the board of directors. The MIT, an external consultant to the Company, brings over 25 years of IT experience in the private financial sector, with a strong focus on cybersecurity. He has
implemented core IT policies, including Information Security and Incident Response, and directed cybersecurity training and testing at the Company. The MIT has also managed cloud infrastructure on Amazon Web Services and integrated automation
within trade order management systems. His expertise extends to managing IT for live trading environments and ensuring regulatory compliance. The MIT holds an MA from the State University of New York at Binghamton and a BA from Luther College.
Additionally, the Company engages a third-party provider to manage key functions, including identity access management, network
security, user and email administration, data governance, threat management, and endpoint security.
|
| Cybersecurity Risk Role of Management [Text Block] |
Our board of directors is responsible for understanding the primary risks to our business. The board is also tasked
with developing and advancing our cybersecurity strategy, as well as evaluating the adequacy of our programs and policies. The CEO is responsible for ensuring that the board of directors comprehends the Company’s cybersecurity risk profile and
receives updates on the program and its policies on a quarterly basis or as necessary. Our current CEO is Jeffrey Lown II. Mr. Lown has a B.S. in Finance from Lehigh University and an
M.B.A. from the D’Amore-McKim School of Business at Northeastern University. Mr. Lown was appointed the Company’s President and CEO in October 2013.
As mentioned above, the CEO is responsible for the initial assessment and management of potential incidents. Furthermore, the Company has established a response plan that serves as the
foundation for addressing unauthorized cybersecurity occurrences from both a technical and regulatory perspective. The Cybersecurity Response Team (“CRT”), comprised of the CEO, General Counsel, Manager of Information Technology (“MIT”) and other personnel as each may designate, are responsible for leading all incident management and response activities. The MIT assumes a crucial role in overseeing and managing the technical facets of the CRT while the CEO provides strategic direction and decision-making, facilitating communication with other members of senior management, and disseminating pertinent information to the board of directors. The MIT, an external consultant to the Company, brings over 25 years of IT experience in the private financial sector, with a strong focus on cybersecurity. He has
implemented core IT policies, including Information Security and Incident Response, and directed cybersecurity training and testing at the Company. The MIT has also managed cloud infrastructure on Amazon Web Services and integrated automation
within trade order management systems. His expertise extends to managing IT for live trading environments and ensuring regulatory compliance. The MIT holds an MA from the State University of New York at Binghamton and a BA from Luther College.
Additionally, the Company engages a third-party provider to manage key functions, including identity access management, network
security, user and email administration, data governance, threat management, and endpoint security.
In conjunction with the aforementioned plans, the Company conducts an annual business impact analysis to identify the critical business
functions that are required by the Company to sustain business operations and potential impacts to the Company if any those critical functions are disrupted. Deriving from the analysis, the Company maintains a business continuity and disaster
recovery plan to coordinate business recovery to resume any disrupted critical business operations. In the event of a critical cybersecurity business disruption, the CEO of the Company may activate the business continuity plan to implement
risk-based strategies devised to maintain business continuity against distributed denial of service attacks or malware.
|
| Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true |
| Cybersecurity Risk Management Positions or Committees Responsible [Text Block] |
As mentioned above, the CEO is responsible for the initial assessment and management of potential incidents. Furthermore, the Company has established a response plan that serves as the
foundation for addressing unauthorized cybersecurity occurrences from both a technical and regulatory perspective. The Cybersecurity Response Team (“CRT”), comprised of the CEO, General Counsel, Manager of Information Technology (“MIT”) and other personnel as each may designate, are responsible for leading all incident management and response activities. The MIT assumes a crucial role in overseeing and managing the technical facets of the CRT while the CEO provides strategic direction and decision-making, facilitating communication with other members of senior management, and disseminating pertinent information to the board of directors. The MIT, an external consultant to the Company, brings over 25 years of IT experience in the private financial sector, with a strong focus on cybersecurity. He has
implemented core IT policies, including Information Security and Incident Response, and directed cybersecurity training and testing at the Company. The MIT has also managed cloud infrastructure on Amazon Web Services and integrated automation
within trade order management systems. His expertise extends to managing IT for live trading environments and ensuring regulatory compliance. The MIT holds an MA from the State University of New York at Binghamton and a BA from Luther College.
Additionally, the Company engages a third-party provider to manage key functions, including identity access management, network
security, user and email administration, data governance, threat management, and endpoint security.
|
| Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | The MIT, an external consultant to the Company, brings over 25 years of IT experience in the private financial sector, with a strong focus on cybersecurity. He has
implemented core IT policies, including Information Security and Incident Response, and directed cybersecurity training and testing at the Company. The MIT has also managed cloud infrastructure on Amazon Web Services and integrated automation
within trade order management systems. His expertise extends to managing IT for live trading environments and ensuring regulatory compliance. The MIT holds an MA from the State University of New York at Binghamton and a BA from Luther College.
Additionally, the Company engages a third-party provider to manage key functions, including identity access management, network
security, user and email administration, data governance, threat management, and endpoint security. |
| Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] |
In conjunction with the aforementioned plans, the Company conducts an annual business impact analysis to identify the critical business
functions that are required by the Company to sustain business operations and potential impacts to the Company if any those critical functions are disrupted. Deriving from the analysis, the Company maintains a business continuity and disaster
recovery plan to coordinate business recovery to resume any disrupted critical business operations. In the event of a critical cybersecurity business disruption, the CEO of the Company may activate the business continuity plan to implement
risk-based strategies devised to maintain business continuity against distributed denial of service attacks or malware.
|
| Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true |