v3.25.4
Cybersecurity Risk Management and Strategy Disclosure
12 Months Ended
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Abstract]  
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block]

Risk Management & Strategy.

 

The Company uses an enterprise risk management and financial framework to oversee its risks, including risks from cybersecurity incidents, as further described below. The Company’s information technology & cybersecurity risk management is a continuous process that includes identification, assessment, classification, and management of threats that could adversely impact our ability to maintain the integrity of Bank data and systems, prevent unauthorized access to confidential data and Bank systems, and achieve the Company’s operational, financial, legal and regulatory compliance requirements or objectives. Please see Item 1A. Risk Factors – Risks Related to Cybersecurity and Data Privacy – “We Face Cybersecurity Risks and Risks Associated With Security Breaches Which Have the Potential to Disrupt Our Operations, Cause Material Harm to Our Financial Condition, Result in Misappropriation of Assets, Compromise Confidential Information and/or Damage Our Business Relationships and Can Provide No Assurance That the Steps We and Our Service Providers Take in Response to These Risks Will Be Effective” for our disclosures regarding the most pertinent risks we may experience from cybersecurity threats.

 

The Bank has a management-level Strategic Technology Oversight Committee (the “TOC”). Members of the TOC include the Bank’s Chief Operating Officer, Chief Risk Officer, Chief Information Officer, and the Information Security Officer (the “ISO”), as well as representatives of each department, including Senior Officers and/or their designees. The TOC reviews the status of various tactical and strategic projects; emerging technologies; cybersecurity, availability and performance metrics; audit results; IT and Business Continuity policies; Business Continuity test results and IT & Cybersecurity Risk Assessment results to monitor the extent of risk, evaluate the effectiveness of mitigating controls in place and ensure the level of risk remains within tolerance through acceptance, or further mitigation, transfer or elimination of the risk.

 

Additionally, the Bank has an Information Security Oversight and Metrics Committee (the “ISO Metrics Committee”) which meets on a monthly basis with a focus on cybersecurity. Members of the ISO Metrics Committee include the ISO, the Chief Information Officer, the Chief Risk Officer, as well as members of the information technology team involved with cybersecurity and infrastructure. The function of the ISO Metrics Committee is to review monthly cybersecurity metrics to support discussion of cyber threats, cyber risk trends, and risk mitigation as well as to participate in an annual tabletop business disruption exercise to assess the Bank’s resilience and readiness should such an event occur.

 

All employees participate in cybersecurity and social engineering training. The Board also receives formal training annually. The Bank conducts social engineering tests for employees, including Senior Management, on relevant topics, such as phishing, smishing and deepfakes, throughout the year. We consider employee awareness and training to be a critical component of the Bank’s cybersecurity program and celebrate employees who exemplify strong situational awareness and defense against cyber threats.

 

Third-party relationships, including vendor relationships, can offer the Bank a variety of opportunities to enhance its product and servicing offerings along with facilitating operational functions or business activities. Outsourcing processes or functions does not diminish the Bank’s responsibility to ensure that the third-party activity is conducted in a safe and sound manner and in compliance with applicable laws, regulations, and internal policies. Oversight for the potential risks of third-party relationships lies with the Bank’s management and the Board.

 

The Bank maintains a third-party risk management oversight program to effectively assess, measure, monitor and manage the risks associated with vendor relationships. The Bank manages its third-party relationships through the use of informed risk assessments, due-diligence reviews, and ongoing oversight and monitoring. Information security and cybersecurity risks are included as elements in the third-party risk management process and are assessed for vendor relationships with access to confidential Bank or customer data.

 

The Bank uses industry standard assessment frameworks as part of its overall cybersecurity risk assessment. Industry standard assessment frameworks are used to evaluate the effectiveness of the Bank’s mitigating controls and support initiatives to achieve continuous improvements in the efficacy of the control environment. The Bank’s TOC and Enterprise Risk Management framework provide ongoing oversight and governance of technology and cybersecurity risk management activities to ensure alignment with the Bank’s risk appetite. Independent audits are performed periodically to review the Bank’s mitigating controls as well as to conduct penetration testing of the Bank’s internal and external systems to help assess the effectiveness of the Bank’s security controls. Additionally, on an annual basis, an independent auditor tests our employees’ awareness of and resilience to various social engineering tactics to provide independent verification and to augment the Bank’s internal testing. Results of the audits are reported through the Bank’s Audit Committee, and ultimately to the Bank’s Board.

 

The Bank also has a relationship with a third-party Security Operations Center that provides continuous monitoring of all traffic in our environment for anomalies as well as services, as needed, to assist in conducting forensic analysis, correlation and remediation activities for any potential indications of compromise.

Cybersecurity Risk Management Processes Integrated [Flag] true
Cybersecurity Risk Management Processes Integrated [Text Block] Industry standard assessment frameworks are used to evaluate the effectiveness of the Bank’s mitigating controls and support initiatives to achieve continuous improvements in the efficacy of the control environment. The Bank’s TOC and Enterprise Risk Management framework provide ongoing oversight and governance of technology and cybersecurity risk management activities to ensure alignment with the Bank’s risk appetite. Independent audits are performed periodically to review the Bank’s mitigating controls as well as to conduct penetration testing of the Bank’s internal and external systems to help assess the effectiveness of the Bank’s security controls. Additionally, on an annual basis, an independent auditor tests our employees’ awareness of and resilience to various social engineering tactics to provide independent verification and to augment the Bank’s internal testing. Results of the audits are reported through the Bank’s Audit Committee, and ultimately to the Bank’s Board.
Cybersecurity Risk Management Third Party Engaged [Flag] true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] true
Cybersecurity Risk Board of Directors Oversight [Text Block]

Governance.

 

The Finance and Risk Management Committee is a standing committee of the Board formed in January 2014 to assist the Board and the Executive Committee of the Board in fulfilling their responsibility with respect to the oversight of the Company’s (1) enterprise risk management and financial framework, including all risks associated therewith, including risks related to cyber incidents and (2) policies and practices relating to financial matters, including but not limited to, capital, liquidity and financing, as well as to merger, acquisition and divestiture activity. The Finance and Risk Management Committee reports to the Board regarding the Company’s risk profile, as well as its enterprise risk management framework, including the significant policies and practices employed to manage such risks, as well as the overall adequacy of the enterprise risk management function.

 

Material risks and results from any industry standard risk assessments parties, including any recommendations to further mitigate, transfer or eliminate risks, if applicable, are reported annually to the TOC, as well as to the Board’s Finance and Risk Management Committee, who then reports the results to the Bank’s Board. Further, these results are included in the Board’s annual Information Security Program Report.

 

Technology and cybersecurity risk metrics are two of the Bank’s primary categorical risks defined in the Bank’s enterprise risk management framework. The Enterprise Risk Management Dashboard, which includes ongoing monitoring of current and emerging technology and cybersecurity risks, is presented to the Finance and Risk Management Committee and to the Bank’s Board on a tri-annual basis. In addition, reports on the monitoring of third-party relationships, particularly critical relationships, are presented to the Finance and Risk Management Committee.

 

The Bank’s Board, through the Finance and Risk Management Committee, has oversight of cybersecurity incident disclosures, if applicable. The Finance and Risk Management Committee shall annually review with Management the Company’s Business Continuity Plan (the “BCP”), the BCP Policy, BCP testing results and the Company’s Pandemic Plan and Cyber Incident Response Plan and programs, including materiality determination criteria and escalation protocols with respect to the prompt reporting of material cyber incidents to the Finance and Risk Management Committee and the Bank’s Board. The Finance and Risk Management Committee shall further review with Management and report to the Bank’s Board any cyber incident disclosure reports to or from regulators with respect thereto, and the root cause and remediation and enhancement efforts with respect thereto.

 

The Bank’s Information Technology team (the “IT Team”) is comprised of professionals with technology certifications, or Associate, Bachelor’s or Master’s degrees across business, technology and cybersecurity disciplines. The IT Team maintains and enhances its technical expertise through ongoing participation in business, technology, and cybersecurity training programs, including certifications focused on emerging technologies and evolving cyber-risk practices. 

 

The IT leadership team, consisting of Assistant Vice Presidents and above, bring extensive technical experience primarily aligned with the financial services industry. The Bank’s ISO holds the Certified Cyber Crimes Investigator designation from the International Association of Financial Crimes Investigators and completes ongoing cybersecurity-related continuing education to support improving the Bank’s information security posture.

Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] The Finance and Risk Management Committee is a standing committee of the Board formed in January 2014 to assist the Board and the Executive Committee of the Board in fulfilling their responsibility with respect to the oversight of the Company’s (1) enterprise risk management and financial framework, including all risks associated therewith, including risks related to cyber incidents and (2) policies and practices relating to financial matters, including but not limited to, capital, liquidity and financing, as well as to merger, acquisition and divestiture activity.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] The Finance and Risk Management Committee reports to the Board regarding the Company’s risk profile, as well as its enterprise risk management framework, including the significant policies and practices employed to manage such risks, as well as the overall adequacy of the enterprise risk management function.
Cybersecurity Risk Role of Management [Text Block] The Bank’s Board, through the Finance and Risk Management Committee, has oversight of cybersecurity incident disclosures, if applicable. The Finance and Risk Management Committee shall annually review with Management the Company’s Business Continuity Plan (the “BCP”), the BCP Policy, BCP testing results and the Company’s Pandemic Plan and Cyber Incident Response Plan and programs, including materiality determination criteria and escalation protocols with respect to the prompt reporting of material cyber incidents to the Finance and Risk Management Committee and the Bank’s Board.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] The Bank’s Information Technology team (the “IT Team”) is comprised of professionals with technology certifications, or Associate, Bachelor’s or Master’s degrees across business, technology and cybersecurity disciplines. The IT Team maintains and enhances its technical expertise through ongoing participation in business, technology, and cybersecurity training programs, including certifications focused on emerging technologies and evolving cyber-risk practices. The IT leadership team, consisting of Assistant Vice Presidents and above, bring extensive technical experience primarily aligned with the financial services industry. The Bank’s ISO holds the Certified Cyber Crimes Investigator designation from the International Association of Financial Crimes Investigators and completes ongoing cybersecurity-related continuing education to support improving the Bank’s information security posture.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] Material risks and results from any industry standard risk assessments parties, including any recommendations to further mitigate, transfer or eliminate risks, if applicable, are reported annually to the TOC, as well as to the Board’s Finance and Risk Management Committee, who then reports the results to the Bank’s Board. Further, these results are included in the Board’s annual Information Security Program Report.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] true