ITEM 1C. CYBERSECURITY RISK MANAGEMENT STRAGEY We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.
ITEM 1C. CYBERSECURITY Risk Management Strategy We have developed and implemented cybersecurity risk management processes intended to protect the confidentiality, integrity and availability of our critical systems and information.
Our Chief Information Officer’s experience includes years of working in the cybersecurity field in various industries, including the financial services industry.
Our Chief Information Officer’s experience includes over 10 years of working in the cybersecurity field in various industries, including the financial services industry.
Our cybersecurity risk management program includes: ● physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and customer, employee, bank partner and other third-party information stored on those systems, such as access controls, encryption, data handling requirements and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; ● a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; ● cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; ● a security team responsible for managing our cybersecurity risk assessment processes and security controls; ● the use of external consultants or other third-party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls; ● annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information; and ● a third-party risk management process that includes internal vetting of certain third-party vendors and service providers with whom we may share data.
Our cybersecurity risk management program is integrated into our overall enterprise risk management program. 19 Table of Contents Our cybersecurity risk management program includes: ● physical, technological and administrative controls intended to support our cybersecurity and data governance framework, including controls designed to protect the confidentiality, integrity and availability of our key information systems and customer, employee, bank partner and other third -party information stored on those systems, such as access controls, encryption, data handling requirements and other cybersecurity safeguards, and internal policies that govern our cybersecurity risk management and data protection practices; ● a defined procedure for timely incident detection, containment, response and remediation, including a written security incident response plan that includes procedures for responding to cybersecurity incidents; ● cybersecurity risk assessment processes designed to help identify material cybersecurity risks to our critical systems, information, products, services and broader enterprise Information Technology ("IT") environment; ● a security team responsible for managing our cybersecurity risk assessment processes and security controls; ● the use of external consultants or other third -party experts and service providers, where considered appropriate, to assess, test or otherwise assist with aspects of our cybersecurity controls; ● annual cybersecurity and privacy training of employees, including incident response personnel and senior management, and specialized training for certain teams depending on their role and/or access to certain types of information, such as consumer information; and ● a third -party risk management process that includes internal vetting of certain third -party vendors and service providers with whom we may share data and processes designed to oversee, identify, and reduce the potential impact of a cybersecurity incident at a third -party vendor or service provider or otherwise implicating the third -party technology and systems used.
Over the past fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.
We have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.
While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our Board of Directors, the audit committee of the Board of Directors ("Audit Committee") and senior management. Our cybersecurity risk management program is integrated into our overall enterprise risk management program.
While everyone at our company plays a part in managing cybersecurity risks, primary cybersecurity oversight responsibility is shared by our Board of Directors, the audit committee of the Board of Directors ("Audit Committee") and senior management.